Security Engineer

At Varicent, we’re not just transforming the Sales Performance Management (SPM) market—we’re redefining how organizations achieve revenue success. Our cutting-edge SaaS solutions empower revenue leaders globally to design smarter go-to-market strategies, maximize seller performance, and unlock untapped potential. Varicent stands at the forefront of innovation, celebrated as a market leader in the 2025 Forrester Wave Report for SPM, 2023 Ventana Research Revenue Performance Management (RPM) Value Index, Gartner Peer Insights, 2024 Gartner SPM Market Guide and G2. Our solutions are trusted by a diverse range of global industry leaders like T-Mobile, ServiceNow, Wawanesa Bank, Shaw Industries, Moody’s, Stryker and hundreds more. Here’s why you’ll thrive at Varicent:

• Innovate with Purpose: Build impactful solutions for customers worldwide.
• Join Excellence: Work in a diverse, collaborative, and innovative team.
• Shape the Future: Lead in redefining revenue optimization.
• Grow Together: Unlock your potential in a supportive environment.

Join us at Varicent - where your talent and ambition meet limitless opportunities for success

The Security Engineer is a fully qualified, career-level engineer who independently owns defined security workstreams across operations and engineering. You will own the day-to-day health of assigned security tools, investigate security events end to end, and drive vulnerability and risk outcomes within your area. You receive little instruction on day-to-day work and general direction on new assignments. You break down moderately complex problems, decide the right approach, and make sound decisions with incomplete information, escalating issues that fall outside your domain or carry high business impact. You will partner with Cloud Operations, Engineering, IT and business teams, building working relationships with senior personnel in your area to strengthen our security posture through reliable execution, continuous improvement and risk-based judgement.

Key responsibilities

Security tooling and engineering

• Own the deployment, configuration, testing, monitoring and maintenance of assigned security tools, which may include SIEM, EDR/CNAPP, DLP, ZTNA, WAF, CASB, Secure Web Gateway, URL filtering, email security and application/vulnerability scanning platforms.
• Lead medium size security initiatives end to end; gather requirements, choose the technical approach, then test, pilot and implement.
• Run proof-of-concepts and product evaluations, assess fit against our security standards and recommend a decision to the team.
• As service owner for your tool(s), identify and implement enhancements, keep runbooks current and resolve operational issues without needing direction.
• Document procedures, workflows, architecture diagrams and playbooks for the tools and processes you own.

Security monitoring, triage and incident response

• Independently triage and investigate security events using SIEM, EDR, DLP, WAF, CASB, SWG and email security tools.
• Judge the severity of each event, decide when to contain, close or escalation, and escalatte high-impact incidents promptly.
• Apply incident response playbooks, adapting your approach when a situation does not fit the playbook exactly.
• Document root cause and lessons learned and recommend fixes that prevent recurrence.

Vulnerability management and security testing

• Perform secure baseline reviews, infrastructure, endpoint and application vulnerability scanning, pentest validation and AI red teaming tests.
• Validate findings for accuracy, prioritise them by risk and drive remediation with system owners through to closure.
• Escalate critical risks and zero-day vulnerabilities, and coordinate mitigation steps with affected teams.
• Identify and automate manual steps in vulnerability workflows, and help integrate SAST, DAST, SCA and External Attack Surface Management into CI/CD pipelines.

Risk assessments, threat modeling and third-party risk

• Conduct security risk assessments for internal initiatives, product enhancements, vendors and productivity tools, weighing multiple risk factors to reach a clear recommendation.
• Perform STRIDE threat modeling for internal projects and AI-enabled tools, producing risk reports with practical mitigations.
• Apply working knowledge of Agentic AI concepts and AI security risks to assess AI-related initiatives.
• Complete vendor risk assessments in OneTrust as part of the third-party risk management program.
• Identify and implement improvements to processes and controls within your area of ownership as the Service Owner.
• Stay current on security threats and best practices and share relevant learnings with the team and partner teams.

Kn