Current jobs related to Security Engineer - Remote Canada ON - Jonas Software
-
Staff Security Engineer
2 weeks ago
Remote, Canada Shakepay Full timeAt Shakepay, we're on a mission to usher in the Bitcoin golden age. We're reimagining financial services to give every Canadian their fair shake. Our culture is built around doing work that matters, winning as a team, and celebrating success. If you're the kind of person who values growth, shipping fast, and sharing your ideas openly with a group of...
-
Staff Security Engineer
1 week ago
Remote, Canada Shakepay Full timeAt Shakepay, we're on a mission to usher in the Bitcoin golden age. We're reimagining financial services to give every Canadian their fair shake.Our culture is built around doing work that matters, winning as a team, and celebrating success. If you're the kind of person who values growth, shipping fast, and sharing your ideas openly with a group of...
-
Security Software Engineer
1 week ago
Remote (Canada) Tailscale Full timeJob Description We're seeking a talented software engineer, specializing in security and privacy, to help grow our product security team. We're looking for people who can move Tailscale forward while making it safer to use. The abilities to think on your feet, collaborate with highly technical teams, and be comfortable working asynchronously are essential. ...
-
Senior Security Engineer
25 minutes ago
Remote - Canada Samsara Full timeAbout the role:We're seeking a talented Senior Security Engineer with hands-on experience deploying, managing, and operating modern Vulnerability Management platforms. In this role, you'll work alongside technical product managers and engineers across the company to maintain Samsara's Vulnerability Management infrastructure and de-risk software...
-
Staff Security Engineer
3 days ago
Remote, Canada Shakepay Full timeAt Shakepay, we're on a mission to usher in the Bitcoin golden age. We're reimagining financial services to give every Canadian their fair shake. Our culture is built around doing work that matters, winning as a team, and celebrating success. If you're the kind of person who values growth, shipping fast, and sharing your ideas openly with a group of...
-
Staff Security Engineer
3 days ago
Remote, Canada Shakepay Full timeAt Shakepay, we're on a mission to usher in the Bitcoin golden age. We're reimagining financial services to give every Canadian their fair shake.Our culture is built around doing work that matters, winning as a team, and celebrating success. If you're the kind of person who values growth, shipping fast, and sharing your ideas openly with a group of...
-
Product Security Engineer
2 days ago
Canada (remote) ClickHouse Full timeAbout ClickHouseRecognized on the 2025 Forbes Cloud 100 list, ClickHouse is one of the most innovative and fast-growing private cloud companies. With over 2,000 customers and ARR that has more than quadrupled over the past year, ClickHouse leads the market in real-time analytics, data warehousing, observability, and AI workloads. ClickHouse's incredible...
-
Security Operations Engineer
1 week ago
, , Canada Prophet Security, Inc. Full timeWho We Are Security teams are drowning in alerts, fragmented workflows, and tools that don’t talk to each other. Adversaries are moving faster than ever, deploying ransomware or stealing data in hours instead of days. Organizations don’t want more alerts. They want broad coverage without being limited by human time. They need systems that can recognize...
-
Senior Security Engineer
1 hour ago
Remote - Canada Samsara Full timeAbout the role:We're seeking a talented Senior Security Engineer with hands-on experience deploying, managing, leading and performing Threat Models In this role, you'll work alongside technical product managers and engineers across the company to maintain Samsara's security and de-risk software security concerns to better protect our customers.We seek...
-
Security Infrastructure Engineer
1 week ago
Remote (Canada) Tailscale Full timeJob Description We're seeking a talented software engineer, specializing in security and infrastructure, to help grow our product security team. We're looking for people who can move Tailscale forward while making it safer to use. The abilities to think on your feet, collaborate with highly technical teams, and be comfortable working asynchronously are...
Security Engineer
2 weeks ago
Job Description: Security EngineerCompensation: The expected salary range for this role is between $135,000 and $150,000, depending on experience and qualifications.Reason for Opening: Net New positionAI is not used to screen, assess, or select applicants for this role.The CompanyConstellation Payment Processing is a modern Payment Facilitator (PayFac) empowering SaaS businesses to grow revenue through seamless, embedded payments. As part of Constellation Software Inc. (TSE:CSU) — a global Canadian-based software leader at a $96B market cap and the 7th largest software company in the world — we combine the agility of a specialized payments company with the strength and stability of an established global powerhouse.We are building a cloud-native PayFac platform on AWS: microservices (DDD) across TypeScript/JavaScript, Java, and Ruby, with a ReactJS front end. As our Security Engineer,you will co-own the DevSecOps program—driving continuous security automation,compliance automation, and penetration testing. You will design and orchestrate SAST/SCA/DAST across our services, champion remediation practices, and partner closely with our compliance team to translate control objectives into repeatable, automated evidence.Our customers are ISV vendors who embed payments by integrating with our APIs, SDKs,and webhooks. That means security and compliance aren't afterthoughts—they are productfeatures. You will ensure our developer-facing surface area is secure by default:establishing standards for authentication and authorization (OIDC/OAuth2/JWT, mTLS/JWS for webhooks), key and secret management, request signing, idempotency, rate-limiting/abuse controls, and secure data handling that minimizes PCI scope for ISVs (tokenization, hosted fields/iframes, PAN vault boundaries, network tokens).You will create secure integration patterns (reference apps, checklists, threat models/DFDs) so partners can implement quickly without compromising controls.Because we operate a multi-tenant PayFac, you will harden isolation boundaries (network,identity, and data), lead supply-chain security (SBOMs, signing/provenance, gateddeployments), and build continuous evidence for PCI DSS 4.0 (and SOC 2/ISO asneeded).You will collaborate with partner security and compliance teams on due-diligencerequests (SIG Lite, AOC/ROCs, shared-responsibility matrices), and you will own pre-launchsecurity reviews for new ISV integrations. You will also help run incident response drills anddefine partner-facing comms and SLAs for security events.Finally, you will research and implement AI-assisted security (triage, anomaly detection,auto-remediation PRs) with appropriate guardrails, and own KPIs that demonstratemultiplier effects—e.g., reduced MTTR, lower false-positive rates, higher auto-triagecoverage, and faster time-to-evidence—so our platform's security posture continuouslyimproves as our ISV ecosystem scales.What You will Do• Own Security Automationo Design, implement, and run the CI/CD security toolchain: SAST, SCA, DAST,container and IaC scanning, secrets detection, SBOM generation, andpolicy-as-code.o Integrate scanners into GitHub/GitHub Actions pipelines with PR gates, andauto-ticketing to JIRA; tune noise, baselines, and break-glass rules.o Establish vulnerability management SLAs, risk acceptance workflow, andmetrics dashboards (e.g., MTTR, vuln burn-down).• Embed Security in the SDLCo Create lightweight secure-coding standards and review checklists forTypeScript/Node, Java, Ruby, React.o Run threat modeling (STRIDE/PASTA) and produce DFDs (L0–L2) for new andhigh-risk flows.o Lead a "security champions" program with engineering squads.• Platform & Cloud Security (AWS/EKS)o Harden EKS workloads (admission controls, pod security, image signing,runtime protection), ECR scanning, and supply-chain security.o Implement and iterate on IAM least-privilege, KMS/CloudHSM keymanagement, network segmentation, WAF/Shield, CloudFront, GuardDuty/Security Hub, and centralized logging.o Validate service-to-service auth (mTLS, OIDC, JWT), secrets management(AWS Secrets Manager/SSM), and data protection at rest/in transit (FIPSvalidatedcrypto).o Manage security certificate adoption our own and 3rd party across the company technology stack.• Compliance Automationo Map controls and automate evidence for PCI DSS 4.0 (and SOC 2/ISO 27001 as needed): continuous monitoring, detector-to-control mappings, and audit-ready artifacts.o Partner with compliance on policies, risk register, third-party/vendor assessments, and control testing cadence.• Penetration Testing & Responseo Scope and coordinate internal and third-party penetration tests (API, web, mobile, cloud); plan fix-verification and retests.o Contribute to incident response playbooks, tabletop exercises, and forensics runbooks.o Participate in incident response events and be a key contributor on improving security posture• Research & implement AI security tools:o Evaluate and deploy AI/ML capabilities (LLM-assisted code reviews, AI triage for SAST/SCA/DAST, anomaly detection over logs/telemetry, drift detection) to reduce toil and increase signal quality—without leaking sensitive code or data.• Own outcomes & KPIs:o Define baselines, instrument dashboards, and continuously tune models/policies to demonstrably improve detection efficacy, remediation speed, and compliance evidence quality.• Guardrails & governance:o Establish safe-use patterns (PII redaction, repository allowlists, prompt/content controls, human-in-the-loop), document model/feature risks, and keep audit trails that map to PCI DSS 4.0 controls.• Automation & SOAR integration:o Orchestrate AI-assisted enrichment and response (e.g., auto-labeling, deduplication, prioritization, suggested fixes/PRs) across CI/CD, SIEM, ticketing, and chat.KPIs You will Own• MTTR for high-severity vulns/incidents: ↓ 40–60% vs. baseline within 2–3 quarters.• Alert noise reduction (precision/FP rate): ≥ 50% reduction in false positives on gated scans and detections.• Auto-triage coverage: ≥ 70% of scanner findings enriched and prioritized by AI with reviewer acceptance ≥ 90%.• AI-generated remediation PRs: ≥ 30% of low/medium issues fixed via assisted PRs passing CI policy.• Time-to-evidence (PCI 4.0 controls): ↓ 50% for recurring audits via automated control artifacts.• Signed-off service coverage: ≥ 90% of services covered by AI-backed detections and scan triage.What You will Bring• 8–10 years in application/cloud security or DevSecOps for high-availability platforms (fintech/payments ideal).• Hands-on DevSecOps program administration experience with Veracode.• Fluent in Terraform for the AWS Stack• Strong CI/CD experience (GitHub Actions preferred) and automation in Python/TypeScript/Bash.• Solid AWS security fundamentals: IAM, KMS, CloudTrail, Config, Security Hub, GuardDuty, VPC/LBs, WAF/Shield; Kubernetes/EKS hardening experience.• Familiarity with microservices, event-driven systems, and DDD; ability to read code in TypeScript/Java/Ruby and basic ReactJS patterns.• Working knowledge of PCI DSS 4.0 control objectives (tokenization/PAN handling, key management, segmentation, logging/retention), plus SOC 2/ISO 27001 concepts.• Clear communication with engineers and non-technical stakeholders; bias toautomate and simplify.• Bonus Point: Payments domain exposure: EMV/3DS, PAN vaulting, network tokenization, P2PE, dispute/chargeback flows.How We will Measure Success• 90 days: Security scans embedded in CI for core services with actionable findings; baseline metrics and SLAs defined; initial PCI 4.0 control mappings complete.• 6 months: False-positive rate
