Senior Security Developer

Who you are

• Is familiar with the software development lifecycle end to end, well enough to recognize where a vulnerability was actually introduced in the process and to tell when an AI tool is hallucinating a finding instead of catching a real one
• Has 4+ years of hands-on vulnerability management and/or security engineering experience, including scanner integration, triage workflows, and remediation tracking. If vulnerability management isn't explicitly on your resume, you should be able to explain clearly why you understand it anyway
• Has production AWS experience
• Has a strong automation-first mindset. You've built things that replace manual processes
• Has deep familiarity with VM tooling (Tenable, Semgrep, Rapid7, or comparable scanners) and knows how to build integrations on top of them via API
• Understands the difference between package and library vulnerabilities well enough to know where a fix actually belongs, and understands vulnerability classes across application and infrastructure layers (XSS vs. CSRF, code vs. container issues) well enough to have a real conversation with a developer who disagrees with a finding. Knows which scanners belong at which stage of the pipeline (CI, production, network) and how a vulnerability actually ends up running in production, including in containers. Hands-on exposure to SAST/DAST/SCA tooling and OWASP fundamentals helps here
• Has hands-on familiarity with GitHub Actions, ArgoCD, Kubernetes, AMIs, and container images (ECR or comparable). You'll need this to help maintain our VM platform, and because each of these carries its own patch management burden since they all run code
• Understands attack surface and exposure management, including how a basic web app's architecture and traffic flow map to real risk. You'll be making risk acceptance calls, and that requires seeing the actual exposure, not just a CVE score
• Can translate business and partner needs into solutions. You'll spend real time with developers who don't understand a finding, disagree with it, or say a fix didn't work, and you need to work through that without losing the thread
• Has a strong understanding of the programs vulnerability management connects to: CI/CD and deployment pipelines, threat intelligence, and bug bounty or responsible disclosure programs. VM doesn't operate in a vacuum, and we want someone who understands the connections that exist today and the ones that should exist but don't yet
• Is familiar with different compliance programs and vulnerability management controls
• Is actively using AI-assisted development workflows (Claude Code, Cursor, Copilot, or similar) and treats them as a force multiplier, not a novelty
• Experience with security orchestration platforms (Tracecat, Tines, XSOAR, or comparable)
• Experience with bug bounty or responsible disclosure programs like HackerOne
• Familiarity with vulnerability scoring and prioritization frameworks (CVSS, EPSS, SSVC). This is quick to pick up on the job, so it's weighted lower than the items above
• Experience in a fintech or regulated-industry environment
• Open-source security tooling contributions

What the job involves

• Most vulnerability management programs are still built around people manually triaging tickets and chasing down owners. We're taking a different approach: a platform that uses AI-assisted tooling to do a lot of that work for us, and this role is where that gets built. We want you to design the automations, integrations, and workflows that take those fundamentals further: less manual ticket routing, more systems that carry a finding through triage, ownership, and remediation on their own
• The skill set we're after, automation-first thinking, developer-level reasoning, and the ability to build integrations across systems, is what turns a program from manual and reactive into something that runs on its own. That's the job: build the automation and integrations that let our VM tooling handle the load without a person in the loop at every step. We're also building deeper integration with our CRS (Cyber Reasoning System) harness, so a finding can move from triage through automated sandbox validation to a generated fix with less manual handling at each stage
• We use AI-assisted development tools heavily and expect you to use them too
• Own and evolve our custom VM platform, working on deployment, integrations, data model, and automation workflows. This is a greenfield opportunity to shape how the platform grows
• Build automation across the full VM lifecycle: triage, ticket routing, SLA tracking, ownership resolution, and follow-up. We use Claude Code and Tracecat, and you'll be expected to use and extend both meaningfully
• Take a platform built around one team's workflow to one that fits how the rest of engineering actually works. Get it in front of people, bake it into their existing processes, and make it something teams reach for
• Integrate scanner data into our VM pipeline and maintain the enrichment workflows that turn raw findings into actionable tickets
• Build the queries, dashboards, and automated reports that give the team and leadership clear visibility into vulnerability posture
• Stay current on the threat landscape, especially the growing role of AI in vulnerability research and exploitation, and factor that into how we build and prioritize
• Help build toward a future where a validated finding gets tested and patched by CRS in a sandbox, and comes back out as a PR, closing the loop with minimal manual work

Benefits

• Retirement savings matching plan through Wealthsimple Work
• Company equity for full-time employees
• Access to Premium Client perks, including personal finance learning & advice and a boosted interest rate on deposits
• Paid parental leave (6 months topped up to 100% of salary)
• 20 vacation days per year
• 90 Days Away program
• Top-tier health benefits
• Life & disability insurance
• Generous sick and mental health days
• Employee resource plan including services like RMT, psychology, and physiotherapy
• Up to $5,000 per year for mental health supports
• Gender Affirmation benefits
• Up to $1,500 per year for professional development
• Up to $1,500 per year for wellness and home office expenses
• Employee resource groups
• Social impact hours