Information Security Engineer (DevSecOps)

Equinix • Toronto, ON

4d • $106,000 - $159,000

About The Position

The Information Security Engineer (DevSecOps), described in the job summary as an Application Security Engineer, strengthens and continuously improves the security posture of the organization’s applications. The role integrates security into the software development lifecycle (SDLC), embeds and automates application security testing in CI/CD pipelines, and drives timely remediation of identified vulnerabilities.

The engineer works closely with application teams to perform threat modeling and security design and architecture reviews, assess and prioritize vulnerabilities, and provide guidance on remediation, secure coding, and security best practices. The role also builds automation for security tooling and policy enforcement, tracks application security posture, and reports metrics to stakeholders and management.

Requirements

• 4–5 years of work experience in Application Security or DevSecOps in a medium or large corporate environment.
• Hands-on experience with SCA tooling, such as Apiiro, Nexus IQ, or Snyk.
• Hands-on experience with SAST tooling, such as SonarQube or Semgrep.
• Hands-on experience with secret-scanning tooling.
• Hands-on experience with DAST or API security tooling, such as Traceable or Burp Suite.
• Hands-on experience with threat modeling.
• Hands-on experience with GitHub Actions.
• Hands-on experience with Terraform.
• Experience collaborating with application teams to recommend security best practices and remediate identified vulnerabilities.
• Hands-on experience with CI/CD tools such as GitHub Actions, including integrating security scans and quality gates into pipelines.
• Strong understanding of OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, and related standards such as NIST and CIS Benchmarks, with the ability to recommend aligned solutions.
• Understanding of AI and LLM security risks and mitigations, including OWASP Top 10 for LLM Applications, prompt injection, data leakage, and model and AI supply-chain risks.
• Working knowledge of common vulnerability classes, including injection, XSS, SSRF, broken access control, and insecure deserialization, and how to remediate them in code.
• Working knowledge of securing applications built on public cloud services from any major cloud provider.
• Ability to partner with application teams to remediate vulnerabilities and adopt secure coding practices.
• Demonstrated ability to work within globally dispersed and cross-functional teams.

Nice To Haves

• A bachelor’s degree in computer science, engineering, or a related field is preferred.

Responsibilities

• Integrate, operate, and continuously improve SAST, SCA, secret-scanning, and DAST tools within the SDLC.
• Implement shift-left security practices so vulnerabilities are detected and remediated early in the SDLC.
• Conduct threat modeling, secure design reviews, and architecture reviews with application teams to identify and mitigate risks early.
• Triage, validate, and prioritize security findings; tune rules, policies, and quality gates to reduce false positives.
• Partner with application teams to provide actionable vulnerability-remediation guidance and track findings through closure.
• Recommend and promote security best practices and secure coding standards, and educate developers about common vulnerability classes.
• Build and maintain automation and scripts, such as Python and Terraform, to onboard applications to security tooling, enforce policy as code, and report application security metrics.
• Track and report application security posture, including vulnerability trends, remediation timelines, and tool coverage, to stakeholders and management.
• Model Equinix culture and values.

Benefits

• Employee Assistance Program.
• Health insurance and healthcare coverage options, depending on country.
• Life insurance.
• Disability insurance.
• Voluntary or optional insurance and benefit plans.
• Retirement or savings plans, including employer and employee contributions in the United States and sponsored pension or savings plans in Canada.
• Accrued paid time off, vacation or personal time, and paid holidays.
• Bonus eligibility; equity may be offered depending on the position.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed