About this role
Accountabilities
- Design and implement processes for building, maintaining, and distributing hardened container base images for development and production environments, with a focus on minimizing attack surfaces.
- Provide technical guidance and engineering solutions to secure Kubernetes clusters and containerized workloads, including runtime security, network policies, and admission controllers.
- Strengthen end-to-end infrastructure supply chain security across CI/CD tooling, Infrastructure as Code (IaC) templates, container images, Helm charts, and third-party dependencies.
- Build and contribute to security automation initiatives, including the development of custom tools and engineering solutions.
- Identify, assess, and triage vulnerabilities discovered through application security reviews, internal penetration testing, Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA).
- Partner with engineering teams to prioritize vulnerabilities, define remediation plans, and drive fixes across systems and applications.
- Develop, implement, and contribute patches to remediate security vulnerabilities at scale.
- Explore and apply AI, machine learning, LLMs, and related techniques to security automation, including automated vulnerability remediation and intelligent alert grouping.
Requirements:
- Post-secondary degree in Computer Science, Information Security, or a related discipline, or equivalent practical experience.
- Extensive hands-on experience with container security, including designing and deploying hardened container images and securing Kubernetes clusters.
- Practical experience with Infrastructure as Code tools, particularly Terraform, to provision and maintain security controls.
- Strong experience building and operating security automation solutions, with software development proficiency in Go and/or Python.
- Advanced knowledge of GitHub and CI/CD platforms, including GitHub Actions and Jenkins, from both architectural and engineering perspectives.
- Expert-level familiarity with Software Composition Analysis (SCA), including hands-on remediation of third-party and open-source dependency vulnerabilities at scale.
- Direct experience or a strong conceptual understanding of applying AI, machine learning, Large Language Models (LLMs), or Model Context Protocol (MCP) techniques to security challenges.
- Strong knowledge of cloud platforms, particularly AWS and Azure, including their security services and container orchestration capabilities.
- Proven ability to collaborate with engineering teams, communicate technical risks, and drive vulnerability remediation initiatives.
Nice to have:
- Experience working with Artifactory or JFrog.
- Advanced knowledge of application security principles, including the OWASP Top 10.
- Familiarity with software supply chain security frameworks such as SLSA.
Benefits:
- Contract engagement with an initial duration of 5+ months .
- Competitive hourly compensation:
T4 rate: CAD $65–$70 per hour.
- Full-time workload of approximately 40 hours per week.
- Remote working arrangement, with Toronto, Ontario also listed as a location.
- Opportunity to contribute to strategic cloud-native security initiatives and emerging AI-driven security solutions.
How Jobgether works:
We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.
We appreciate your interest and wish you the best!
Why Apply Through Jobgether?
Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.
#LI-CL1