Security Engineer

Independently triage and investigate security events using SIEM, EDR, DLP, WAF, CASB, SWG and email security tools.

Judge the severity of each event, decide when to contain, close or escalate, and escalate high-impact incidents promptly.

Apply incident response playbooks, adapting your approach when a situation does not fit the playbook exactly.

Document root cause and lessons learned and recommend fixes that prevent recurrence.

Perform secure baseline reviews, infrastructure, endpoint and application vulnerability scanning, pentest validation and AI red teaming tests.

Validate findings for accuracy, prioritise them by risk and drive remediation with system owners through to closure.

Escalate critical risks and zero-day vulnerabilities, and coordinate mitigation steps with affected teams.

Identify and automate manual steps in vulnerability workflows, and help integrate SAST, DAST, SCA and External Attack Surface Management into CI/CD pipelines.

Conduct security risk assessments for internal initiatives, product enhancements, vendors and productivity tools, weighing multiple risk factors to reach a clear recommendation.

Perform STRIDE threat modeling for internal projects and AI-enabled tools, producing risk reports with practical mitigations.

Apply working knowledge of Agentic AI concepts and AI security risks to assess AI-related initiatives.

Complete vendor risk assessments in OneTrust as part of the third-party risk management program.

Identify and implement improvements to processes and controls within your area of ownership as the Service Owner.

Stay current on security threats and best practices and share relevant learnings with the team and partner teams.

5+ years of experience in Information Security, Security Engineering or Security Operations with a Bachelor's degree in Information Security, Computer Science, Computer Engineering, Technology Management or a related field; or equivalent work experience.

At least one information security certification (e.g., CISSP, CISA, CCSP or equivalent).

Full working knowledge of securing cloud environments, operating systems, networks, databases and applications.

Hands-on experience operating public cloud platforms (e.g., AWS, IBM Cloud).

Hands-on experience owning security tools such as SIEM, WAF, DLP, EDR and infrastructure/application vulnerability scanners.

Understanding of security frameworks (e.g., NIST CSF, ISO 27001/27002) and experience supporting controls aligned to SOC 1, SOC 2, PCI and HIPAA.

Proven ability to break down problems, choose an approach and make sound decisions with incomplete information, which ultimately leads to solutions.

Strong written and verbal communication, including explaining risk clearly to technical and non-technical stakeholders.

High accountability and a continuous learning mindset.

Fluent in English.

Experience integrating security checks into CI/CD pipelines (e.g., scanning, alerting, ticket creation, gating).

Security automation with Python, PowerShell or Bash.

Hands-on experience with OneTrust workflows, evidence management and assessment reporting.

Experience conducting risk assessments with the STRIDE methodology.

What success looks like First 1–3 months: Ramp up and own the day-to-day

Become proficient with our security tooling, alert queues and incident response workflows, and take ownership of assigned tools.

Handle triage and investigations independently, with high-quality documentation and well-judged escalation.

Assess current vulnerability scanning coverage and propose improvements to data quality and prioritisation.

Months 4–6: Own a service(s) and improve processes

Be the subject matter expert for a service and associated capabilities and processes from requirements through implementation.

Improve vulnerability management outcomes through better triage, stakeholder follow-through and closure rates.

Deliver risk assessments and STRIDE threat models for assigned projects, including AI-enabled tools, with minimal review.

Month 7 onward: Measurable impact in your domain

Show measurable efficiency gains in your area through automation, process maturity or better signal quality.

Reduce recurring security issues in your area through root-cause-driven fixes.

Be a trusted security partner to Engineering, Cloud and IT teams through consistent execution and practical recommendations.

The expected base salary range for this role is C$105,000 – C$130,000, and individuals may be eligible to participate in our variable compensation program. Final compensation may vary based on experience, skills, designations and market conditions.

This posting is for an existing vacancy. This hiring process uses artificial intelligence tools to assist in candidate screening and assessment. Our AI tools are designed to complement, not replace, human decision-making.

Varicent is committed to creating a diverse environment and is proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, or veteran status. If you require accommodation at any time during the recruitment process please email [email protected]

Varicent is also committed to compliance with all fair employment practices regarding citizenship and immigration status. By applying for a position at Varicent and/or by using this portal, you declare and confirm that you have read and agree to our Job Applicant Privacy Notice and that the information provided by you as part of your application is true and complete and includes no misrepresentation or material omission of fact