Security Engineer

Responsibilities

The Security Engineer will independently manage security tools, investigate security events, and drive vulnerability remediation across the organization. They will also conduct risk assessments, perform threat modeling, and collaborate with engineering teams to strengthen the overall security posture.

Requirements

Candidates must have at least 5 years of experience in Information Security or Security Engineering and hold at least one relevant certification such as CISSP or CISA. A bachelor's degree in a related field is required, along with hands-on experience in cloud platforms and security tooling.

Skills

• Security engineering
• SIEM
• EDR
• CNAPP
• DLP
• ZTNA
• WAF
• CASB
• Vulnerability management
• Incident response
• Threat modeling
• Cloud security
• AWS
• Python
• PowerShell
• Bash

About this role

At Varicent, we’re not just transforming the Sales Performance Management (SPM) market—we’re redefining how organizations achieve revenue success. Our cutting-edge SaaS solutions empower revenue leaders globally to design smarter go-to-market strategies, maximize seller performance, and unlock untapped potential. Varicent stands at the forefront of innovation, celebrated as a market leader in the 2025 Forrester Wave Report for SPM, 2023 Ventana Research Revenue Performance Management (RPM) Value Index, Gartner Peer Insights, 2024 Gartner SPM Market Guide, and G2. Our solutions are trusted by a diverse range of global industry leaders like T-Mobile, ServiceNow, Wawanesa Bank, Shaw Industries, Moody's, Stryker and hundreds more. Here’s why you’ll thrive at Varicent:
Innovate with Purpose: Build impactful solutions for customers worldwide.
Join Excellence: Work in a diverse, collaborative, and innovative team.
Shape the Future: Lead in redefining revenue optimization.
Grow Together: Unlock your potential in a supportive environment.
Join us at Varicent—where your talent and ambition meet limitless opportunities for success!
The Security Engineer is a fully qualified, career-level engineer who independently owns defined security workstreams across operations and engineering. You will own the day-to-day health of assigned security tools, investigate security events end to end, and drive vulnerability and risk outcomes within your area.

You receive little instruction on day-to-day work and general direction on new assignments. You break down moderately complex problems, decide the right approach, and make sound decisions with incomplete information, escalating issues that fall outside your domain or carry high business impact.

You will partner with Cloud Operations, Engineering, IT and business teams, building working relationships with senior personnel in your area to strengthen our security posture through reliable execution, continuous improvement and risk-based judgement.

Key responsibilities

Security tooling and engineering
Own the deployment, configuration, testing, monitoring and maintenance of assigned security tools, which may include SIEM, EDR/CNAPP, DLP, ZTNA, WAF, CASB, Secure Web Gateway, URL filtering, email security and application/vulnerability scanning platforms.
Lead medium size security initiatives end to end; gather requirements, choose the technical approach, then test, pilot and implement.
Run proof-of-concepts and product evaluations, assess fit against our security standards and recommend a decision to the team.
As service owner for your tool(s), identify and implement enhancements, keep runbooks current and resolve operational issues without needing direction.
Document procedures, workflows, architecture diagrams and playbooks for the tools and processes you own.
Security monitoring, triage and incident response
Independently triage and investigate security events using SIEM, EDR, DLP, WAF, CASB, SWG and email security tools.
Judge the severity of each event, decide when to contain, close or escalate, and escalate high-impact incidents promptly.
Apply incident response playbooks, adapting your approach when a situation does not fit the playbook exactly.
Document root cause and lessons learned and recommend fixes that prevent recurrence.
Vulnerability management and security testing
Perform secure baseline reviews, infrastructure, endpoint and application vulnerability scanning, pentest validation and AI red teaming tests.
Validate findings for accuracy, prioritise them by risk and drive remediation with system owners through to closure.
Escalate critical risks and zero-day vulnerabilities, and coordinate mitigation steps with affected teams.
Identify and automate manual steps in vulnerability workflows, and help integrate SAST, DAST, SCA and External Attack Surface Management into CI/CD pipelines.
Risk assessments, threat modeling and third-party risk
Conduct security risk assessments for internal initiatives, product enhancements, vendors and productivity tools, weighing multiple risk factors to reach a clear recommendation.
Perform STRIDE threat modeling for internal projects and AI-enabled tools, producing risk reports with practical mitigations.
Apply working knowledge of Agentic AI concepts and AI security risks to assess AI-related initiatives.
Complete vendor risk assessments in OneTrust as part of the third-party risk management program.
Continuous improvement & Service Ownership
Identify and implement improvements to processes and controls within your area of ownership as the Service Owner.
Stay current on security threats and best practices and share relevant learnings with the team and partner teams.
Knowledge, skills and experience
Required
5+ years of experience in Information Security, Security Engineering or Security Operations with a Bachelor's degree in Information Security, Computer Science, Computer Engineering, Technology Management or a related field; or equivalent work experience.
At least one information security certification (e.g., CISSP, CISA, CCSP or equivalent).
Full working knowledge of securing cloud environments, operating systems, networks, databases and applications.
Hands-on experience operating public cloud platforms (e.g., AWS, IBM Cloud).
Hands-on experience owning security tools such as SIEM, WAF, DLP, EDR and infrastructure/application vulnerability scanners.
Understanding of security frameworks (e.g., NIST CSF, ISO 27001/27002) and experience supporting controls aligned to SOC 1, SOC 2, PCI and HIPAA.
Proven ability to break down problems, choose an approach and make sound decisions with incomplete information, which ultimately leads to solutions.
Strong written and verbal communication, including explaining risk clearly to technical and non-technical stakeholders.
High accountability and a continuous learning mindset.
Fluent in English.
Preferred
Experience integrating security checks into CI/CD pipelines (e.g., scanning, al...

About Varicent

Software Development · 501-1,000 employees · headquartered in Toronto, Ontario · founded 2003