Security Engineer

Security Engineer

About us

TitanFile's mission is to democratize secure client communication. This is a challenge worthy of pursuit! The costs and risks associated with complex projects like litigation, processing insurance claims, and conducting regulatory investigations are skyrocketing as the amount of data increases. TitanFile is transforming these processes so they can be done in minutes, not days, by anyone, anywhere. As a result, our customers, who range from financial institutions to law firms and from government agencies to higher education, can service their clients faster with the privacy and security that they expect.

What we need:

TitanFile is looking for a Security Engineer who is personable, persistent, and confident. A person who is passionate about learning new technologies and improving the skills they already have. A person who wants their work to stand for something. A person able to juggle multiple priorities and work with minimal supervision.

This person will report to our CEO, who leads our security and compliance program, and will work closely with our Lead Architect and Infrastructure Manager and the engineering team. The role is largely hands-on security engineering combined with governance, risk, and compliance: finding and fixing weaknesses across our cloud platform and application, improving detection and incident response, and turning our security controls into automated, auditable evidence.

Our customers hold us to a high bar. TitanFile is SOC 2 Type 2 and ISO 27001 certified, and we are pursuing FedRAMP certification to serve the U.S. federal market. The right security engineer will be pragmatic, able to explain risk in plain language, and able to choose controls that protect our customers without slowing the business down. We expect our engineers to work fluently with AI tooling and to apply the same engineering judgment to what it produces as they would to their own work.

TitanFile offers an incredible opportunity for a Security Engineer to learn and grow, while being part of an awesome growing team in Toronto.

What you'll do:

• Run our vulnerability management program, including scanning, triage, risk rating, and tracking remediation to agreed timeframes across infrastructure, containers, dependencies, and application code
• Help deliver our FedRAMP 20x certification, including control implementation, automated validation of Key Security Indicators, and readiness for independent assessment
• Build security controls and evidence collection as code in Terraform and GitLab CI, so compliance is continuous
• Strengthen logging, monitoring, and threat detection across AWS and Azure, and tune alerts so they are actionable
• Participate in a shared on-call rotation, lead security investigations, and drive post-incident improvements
• Review cloud configuration, identity and access, network design, and encryption against least privilege and secure baselines
• Partner with engineers on secure design reviews, threat modelling, and code review for our Django and Python application
• Coordinate penetration tests and manage findings through to remediation
• Maintain policies, procedures, the risk register, and audit evidence for SOC 2, ISO 27001, and FedRAMP, and support internal and external audits
• Answer customer security questionnaires and support security reviews with enterprise and government customers
• Assess the security of vendors and subprocessors
• Support security awareness training and phishing simulations
• Use AI tooling to work faster across analysis, detection engineering, scripting, and documentation, while holding a high bar for accuracy

Skills:

• Positivity, passion, and creativity for what we do
• Execution-oriented, and energized by a fast-paced startup environment
• Hustle, persistence, and love for excellence and innovation

Qualifications:

• Bachelor's or Master's degree in Computer Science, Software Engineering, Information Security, or a related field, or equivalent experience
• 4 to 7 years of full-time experience in security engineering, cloud security, security operations, or a related role, including at least 2 years of hands-on security work in a cloud environment
• Must be able and willing to lawfully work out of our Toronto, Ontario office on a hybrid schedule
• Able to obtain and maintain Government of Canada security screening at the Secret Status level
• Production experience securing AWS, including IAM, VPC, KMS, CloudTrail, GuardDuty, and Security Hub
• Hands-on vulnerability management experience, including scanning tools, CVSS-based risk rating, and remediation tracking
• Experience with logging, SIEM, or detection engineering, and with incident response
• Proficiency in scripting and automation with Python and Bash
• Solid Linux, networking, and cryptography fundamentals, including TLS, DNS, firewalls, and key management
• Working knowledge of application security and the OWASP Top 10
• Experience with infrastructure as code, ideally Terraform, and CI/CD pipelines, ideally GitLab CI
• Experience supporting a compliance program such as SOC 2, ISO 27001, or FedRAMP, including control implementation and audit evidence
• Fluent use of AI assistants to accelerate security analysis and automation, with the judgment to verify, test, and challenge what they produce
• Fluent written and verbal communication in English, including explaining risk to non-technical audiences

Nice to have:

• Experience with FedRAMP, FedRAMP 20x, or NIST SP 800-53
• Experience with ITSG-33 or other Government of Canada security requirements
• Experience with ISO 27017, ISO 27018, or privacy laws such as PIPEDA and GDPR
• Experience securing containerized workloads, ideally ECS
• Experience with Django or Python application environments
• Security certifications such as CISSP, CCSP, OSCP, CISA, or AWS Certified Security Specialty
• Experience at a SaaS company serving regulated industries

Why TitanFile:

• Join a team of highly effective professionals working to solve two of the biggest challenges in the digital age: communication and privacy
• Opportunity to build a career and grow professionally
• Flexible work hours
• Excellent benefits packages

No agencies please.