Staff Security Engineer | Security Engineering

Role overview

Required qualifications

• At least eight years of hands-on security or systems engineering experience in large-scale enterprise environments.
• Expert Linux administration and troubleshooting across OS internals, networking, storage, virtualization, and containers; proficiency with DNS, NTP, and LDAP.
• Production-grade Python and Shell automation; infrastructure-as-code and configuration management using Terraform, Ansible, or Puppet; CI/CD and Git workflows.
• Network security expertise spanning firewalls, segmentation, load balancers, and proxies; hardening against CIS, STIG, or NIST baselines.
• Experience using AI in work and understanding of Protected B classification and Canadian government data residency requirements.
• Hands-on experience in at least two listed specialty areas: identity and access management, vulnerability management, cloud security, security data platforms, infrastructure security, ServiceNow administration, or ServiceNow Security Operations.
• Must obtain and maintain Government of Canada Reliability Status; screening requires five years of verifiable background history.

Responsibilities

• Serve as senior technical authority for security engineering in the Canadian regulated environment.
• Engineer, harden, and operate controls across on-premises, cloud, and isolated infrastructure.
• Build automation and infrastructure as code for security engineering, operations, reporting, and remediation.
• Partner with infrastructure, application, and platform owners on remediation and CIS/NIST compliance.
• Support identity, vulnerability scanning, logging, and cloud security tools based on team priorities.
• Produce operational and executive-facing security posture and performance reports.

Specialty experience

• Specialties include PAM tools BeyondTrust or CyberArk, SailPoint IIQ, PingFederate or ForgeRock; Tenable SC/IO, CVSS and EPSS; GCP with AWS or Azure, Wiz and CSPM/DSPM/KSPM.
• Other specialties include Splunk, Cribl Stream or Edge, SELinux, AppArmor, auditd, PKI, certificate lifecycle management, container security, ServiceNow administration, and ServiceNow Security Operations.
• ServiceNow administration specialty includes CSA or equivalent experience, workflows, access and data integrity, ITSM modules, JavaScript or GlideScript, and ACLs.
• Preferred qualifications include CISSP, CCSP, CISM, ServiceNow CSA, Tenable Certified Engineer, Cribl Admin, or GCP security certifications; regulated or air-gapped government experience; and ITIL/ITSM knowledge.

Eligibility and work context

• The position supports Government of Canada Protected B workloads; eligible candidates must be Canadian citizens or permanent residents, live in Canada, and perform all work from within Canada.

Additional conditions