Forward - Security Engineer, Network & Infrastructure Security

THE OPPORTUNITY

ShyftLabs is a fast-growing data and technology company that partners with Fortune 500 and enterprise organizations to deliver innovative, data-driven solutions. We specialize in building scalable, enterprise-grade platforms that leverage modern technologies, cloud infrastructure, and advanced engineering practices to solve complex business challenges.

We are seeking a Security Engineer, Network & Infrastructure Security to support enterprise security initiatives for one of our clients. This is a client-facing, individual contributor role that combines deep technical expertise with security architecture advisory, risk assessment, and cross-functional collaboration.

In this role, you will help define, assess, and strengthen security controls across enterprise network and infrastructure environments. You will serve as a trusted technical advisor, partnering directly with client stakeholders across Network Engineering, Infrastructure, Cloud, and Information Security to establish security standards, evaluate architecture and design decisions, and implement scalable security practices.

The ideal candidate brings hands-on experience in network and infrastructure security, a strong understanding of enterprise security architecture, and the ability to communicate complex technical concepts and recommendations to both technical teams and business stakeholders.

What You'll Be Doing

• Define and maintain enterprise security standards, reference architectures, and configuration baselines for next-generation firewalls, intrusion prevention and detection systems, web filtering, TLS inspection, and secure web gateways. Review client network designs and implementations to ensure alignment with security requirements and industry best practices.

• Work directly with client stakeholders to assess security requirements, provide technical recommendations, communicate risks, and guide security architecture and implementation decisions. Collaborate with engineering teams to translate security requirements into practical, scalable solutions.

• Establish and assess security standards for VPN and Zero Trust Network Access (ZTNA) solutions, including platforms such as Palo Alto GlobalProtect. Define access controls, device posture requirements, and compliance monitoring practices.

• Establish standards for Public Key Infrastructure (PKI), certificate authority governance, cryptographic key management, and certificate lifecycle operations. Identify opportunities to automate certificate discovery, renewal, and compliance monitoring.

• Define security requirements for enterprise and cloud DNS architectures, including protective DNS filtering, DNS Security Extensions (DNSSEC), split-horizon DNS, and centralized logging.

• Develop and assess segmentation strategies and Zero Trust architectures across corporate networks, retail environments, payment card industry (PCI) zones, IoT/OT environments, and third-party connections to reduce attack surfaces and limit lateral movement.

• Define and validate security hardening standards for Windows and Linux servers, containers, hypervisors, and network appliances. Apply CIS Benchmarks and automated compliance tools to identify configuration drift and drive remediation.

• Investigate complex network security incidents, connectivity issues, and remote access failures. Conduct root-cause analysis, coordinate remediation with client engineering teams, and provide recommendations to prevent recurrence.

• Ensure relevant network, DNS, proxy, endpoint, and identity telemetry is appropriately captured and integrated into Security Information and Event Management (SIEM) platforms. Partner with security operations teams to improve visibility, detection, and investigation capabilities.

• Review firewall changes, network designs, infrastructure requests, and security exceptions for risk and compliance. Promote least-privilege access, accurate configuration and asset records, and consistent security governance.

• Develop scripts, tools, and workflows to automate security compliance assessments, firewall rule reviews, configuration validation, and security posture reporting using Python, PowerShell, Bash, or similar technologies.

• Assess existing security controls against recognized frameworks and regulatory requirements, including CIS Benchmarks, NIST Cybersecurity Framework, and PCI DSS. Document findings, recommend remediation strategies, and communicate progress to relevant stakeholders.

• Identify opportunities to improve enterprise security architecture, reduce infrastructure exposure, standardize security controls, and embed secure-by-design principles into engineering processes.

What You'll Bring

• 4–6 years of IT or cybersecurity experience, including at least 3 years in network security or infrastructure security engineering, architecture, or advisory roles.

• Hands‑on experience with enterprise firewall and secure access technologies such as Palo Alto, Fortinet, Cisco, or Zscaler.

• Strong understanding of networking fundamentals and protocols, including TCP/IP, routing and switching, VLANs, DNS, DHCP, NAT, VPN, and TLS, with the ability to perform packet-level analysis.

• Working knowledge of PKI, certificate lifecycle management, enterprise DNS security, and cryptographic key management.

• Practical experience with Windows and Linux server hardening, privileged access management, vulnerability remediation, and infrastructure security controls.

• Experience with endpoint detection and response (EDR) platforms, such as CrowdStrike, and SIEM technologies and query languages, such as KQL or SPL.

• Familiarity with security frameworks and compliance standards, including CIS Benchmarks, NIST CSF, and PCI DSS.

• Scripting or automation experience using Python, PowerShell, Bash, or similar languages to support security assurance, compliance validation, and reporting.

• Experience assessing security architecture, reviewing technical designs, documenting standards, and providing actionable security recommendations.

• Strong communication and stakeholder management skills, with the ability to engage directly with clients, explain technical risks, and influence engineering decisions.

• A consultative, collaborative approach to problem-solving, with the ability to balance security requirements, operational constraints, and business priorities.

• Ability to work independently, manage competing priorities, and drive security initiatives through assessment, recommendation, and remediation.

Nice to Have

• Experience securing cloud network infrastructure and logging services across AWS, Microsoft Azure, or Google Cloud Platform (GCP).

• Familiarity with automated certificate management solutions, such as ACME or Venafi, and protective DNS platforms, such as Infoblox or Cloudflare.

• Experience with Infrastructure as Code (IaC) tools, including Terraform or Ansible, and integrating security guardrails into CI/CD pipelines.

• Experience securing distributed enterprise environments, retail edge infrastructure, or IoT/OT networks.

• Working knowledge of compliance requirements such as PCI DSS and SOX.

• Familiarity with IT service management and change management platforms, such as Jira Service Management or ServiceNow.

• Relevant security certifications, including CompTIA Security+, Network+, PCNSE, CCNP Security, AWS or Azure Security certifications, or GIAC credentials.

Salary Range

• $100,000 - $120,000 (CAD)

Inclusion at ShyftLabs

ShyftLabs is an equal-opportunity employer committed to creating a safe, diverse, and inclusive environment. We encourage applicants of all backgrounds including ethnicity, religion, disability status, gender identity, sexual orientation, family status, age, and nationality to apply. If you require accommodation during the interview process, let us know and we’ll be happy to support you.