Security Engineer

The Security Engineer is a fully qualified, career-level engineer who independently owns defined security workstreams across operations and engineering. You will own the day-to-day health of assigned security tools, investigate security events end to end, and drive vulnerability and risk outcomes within your area.

You receive little instruction on day-to-day work and general direction on new assignments. You break down moderately complex problems, decide the right approach, and make sound decisions with incomplete information, escalating issues that fall outside your domain or carry high business impact.

You will partner with Cloud Operations, Engineering, IT and business teams, building working relationships with senior personnel in your area to strengthen our security posture through reliable execution, continuous improvement and risk-based judgement.

Key responsibilities

Security tooling and engineering

• Own the deployment, configuration, testing, monitoring and maintenance of assigned security tools, which may include SIEM, EDR/CNAPP, DLP, ZTNA, WAF, CASB, Secure Web Gateway, URL filtering, email security and application/vulnerability scanning platforms.
• Lead medium size security initiatives end to end; gather requirements, choose the technical approach, then test, pilot and implement.
• Run proof-of-concepts and product evaluations, assess fit against our security standards and recommend a decision to the team.
• As service owner for your tool(s), identify and implement enhancements, keep runbooks current and resolve operational issues without needing direction.
• Document procedures, workflows, architecture diagrams and playbooks for the tools and processes you own.

Security monitoring, triage and incident response

• Independently triage and investigate security events using SIEM, EDR, DLP, WAF, CASB, SWG and email security tools.
• Judge the severity of each event, decide when to contain, close or escalate, and escalate high-impact incidents promptly.
• Apply incident response playbooks, adapting your approach when a situation does not fit the playbook exactly.
• Document root cause and lessons learned and recommend fixes that prevent recurrence.

Vulnerability management and security testing

• Perform secure baseline reviews, infrastructure, endpoint and application vulnerability scanning, pentest validation and AI red teaming tests.
• Validate findings for accuracy, prioritise them by risk and drive remediation with system owners through to closure.
• Escalate critical risks and zero-day vulnerabilities, and coordinate mitigation steps with affected teams.
• Identify and automate manual steps in vulnerability workflows, and help integrate SAST, DAST, SCA and External Attack Surface Management into CI/CD pipelines.

Risk assessments, threat modeling and third-party risk

• Conduct security risk assessments for internal initiatives, product enhancements, vendors and productivity tools, weighing multiple risk factors to reach a clear recommendation.
• Perform STRIDE threat modeling for internal projects and AI-enabled tools, producing risk reports with practical mitigations.
• Apply working knowledge of Agentic AI concepts and AI security risks to assess AI-related initiatives.
• Complete vendor risk assessments in OneTrust as part of the third-party risk management program.

Continuous improvement & Service Ownership

• Identify and implement improvements to processes and controls within your area of ownership as the Service Owner.
• Stay current on security threats and best practices and share relevant learnings with the team and partner teams.

Knowledge, skills and experience

Required

• 5+ years of experience in Information Security, Security Engineering or Security Operations with a Bachelor's degree in Information Security, Computer Science, Computer Engineering, Technology Management or a related field; or equivalent work experience.
• At least one information security certification (e.g., CISSP, CISA, CCSP or equivalent).
• Full working knowledge of securing cloud environments, operating systems, networks, databases and applications.
• Hands-on experience operating public cloud platforms (e.g., AWS, IBM Cloud).
• Hands-on experience owning security tools such as SIEM, WAF, DLP, EDR and infrastructure/application vulnerability scanners.
• Understanding of security frameworks (e.g., NIST CSF, ISO 27001/27002) and experience supporting controls aligned to SOC 1, SOC 2, PCI and HIPAA.
• Proven ability to break down problems, choose an approach and make sound decisions with incomplete information, which ultimately leads to solutions.
• Strong written and verbal communication, including explaining risk clearly to technical and non-technical stakeholders.
• High accountability and a continuous learning mindset.
• Fluent in English.

Preferred

• Experience integrating security checks into CI/CD pipelines (e.g., scanning, alerting, ticket creation, gating).
• Security automation with Python, PowerShell or Bash.
• Hands-on experience with OneTrust workflows, evidence management and assessment reporting.
• Experience conducting risk assessments with the STRIDE methodology.

What success looks like

First 1–3 months: Ramp up and own the day-to-day

• Become proficient with our security tooling, alert queues and incident response workflows, and take ownership of assigned tools.
• Handle triage and investigations independently, with high-quality documentation and well-judged escalation.
• Assess current vulnerability scanning coverage and propose improvements to data quality and prioritisation.

Months 4–6: Own a service(s) and improve processes

• Be the subject matter expert for a service and associated capabilities and processes from requirements through implementation.
• Improve vulnerability management outcomes through better triage, stakeholder follow-through and closure rates.
• Deliver risk assessments and STRIDE threat models for assigned projects, including AI-enabled tools, with minimal review.

Month 7 onward: Measurable impact in your domain

• Show measurable efficiency gains in your area through automation, process maturity or better signal quality.
• Reduce recurring security issues in your area through root-cause-driven fixes.
• Be a trusted security partner to Engineering, Cloud and IT teams through consistent execution and practical recommendations.

The expected base salary range for this role is C$105,000 – C$130,000, and individuals may be eligible to participate in our variable compensation program. Final compensation may vary based on experience, skills, designations and market conditions.

This posting is for an existing vacancy.

This hiring process uses artificial intelligence tools to assist in candidate screening and assessment. Our AI tools are designed to complement, not replace, human decision-making.