{"id":48915,"url":"https://alion.io/job/fispan-senior-security-engineer","title":"Senior Security Engineer","company":{"id":10164,"name":"Fispan","domain":"fispan.com","url":"https://alion.io/company/fispan","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"BambooHR","truth_index":{"grade":"A","score":95,"open_postings":3,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":71,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Vancouver, Canada"],"countries":["CA"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":130000,"max":160000,"currency":"CAD","period":"year","gross":null,"usd_annual":115787},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"Cloudflare","optional":false},{"name":"Configuration Management","optional":false},{"name":"DNS","optional":false},{"name":"Docker","optional":false},{"name":"Fine-tuning","optional":false},{"name":"GDPR","optional":false},{"name":"GitHub","optional":false},{"name":"Google Workspace","optional":false},{"name":"Helm","optional":false},{"name":"ISO 27001","optional":false},{"name":"JFrog Artifactory","optional":false},{"name":"Kubernetes","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PCI DSS","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"SIEM","optional":false},{"name":"Slack","optional":false},{"name":"Snyk","optional":false},{"name":"SQL","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Zero Trust","optional":false},{"name":"Zscaler","optional":false},{"name":"Ansible","optional":true},{"name":"Burp Suite","optional":true},{"name":"CloudFormation","optional":true},{"name":"Cobalt Strike","optional":true},{"name":"Crowdstrike","optional":true},{"name":"Metasploit","optional":true},{"name":"Nessus","optional":true},{"name":"Nmap","optional":true},{"name":"Splunk","optional":true},{"name":"Terraform","optional":true}],"status":"live","first_seen_at":"2026-05-05T00:00:00Z","employer_posted_date":"2026-05-05","last_verified_at":"2026-10-17T13:38:01Z","board_verified":true,"closed_at":null,"days_open":165,"trust":{"level":"ok","repost_count":0,"flags":[],"days_open":165},"description":"Our Business\nFISPAN Services Inc. (FISPAN) is an Enterprise SaaS FinTech company that allows banks to deploy embedded financial products and services to create a seamless banking connection for their corporate clients. Our product aims to provide instant scale and reach for banks who want to remove friction and add value by enabling their commercial banking clients to access banking services through their preferred ERP / accounting platform.\nFounded in 2016 and headquartered in downtown Vancouver, FISPAN is on a mission to create the best product in the FinTech industry and fundamentally change the way that companies bank. Being the market leader in ERP Banking, we work with the world’s Tier 1 banks with assets exceeding $3T, including J.P. Morgan Chase, Wells Fargo, TD and Bank of Montreal.\nWe are looking for dynamic and passionate individuals to join our high performance team and contribute to our rapid growth and exciting journey.\nPosition Overview\nAs a Senior Security Engineer, you will provide senior-level expertise and advanced security analysis capabilities within our organization's security operations. Operating at a senior level, you will be a hands-on defender and attacker-mindset practitioner - running security monitoring, threat detection, and incident response, while proactively finding and closing gaps through vulnerability assessment and penetration testing. You will also apply that offensive mindset to the infrastructure you help secure: fine-tuning our SIEM, hardening cloud environments, implementing Zero Trust Architecture, and securing our CI/CD pipelines. You will champion an automation-first and AI-augmented mindset, using AI tooling and Infrastructure as Code (IaC) to scale detection, response, and testing across the board.\nNote: This role operates on a hybrid schedule, requiring you to be in the downtown Vancouver office 1-3 days per week.\nSecurity Operations & Threat DetectionDrive day-to-day execution of security operations, utilizing AI-assisted analysis to ensure rapid and proper coordination of incident response with all parties of interest.revised\nEnsure all incident tickets are assigned, tracked, and resolved in compliance with operations SLAs.\nImprove alert signal-to-noise ratios and integrate external threat intel with security monitoring tools.\nRegularly update and continuously improve threat detection use cases, using AI tools to assist in rapid rule generation and threat modeling.\nContinuously fine-tune our SIEM to reduce false positives, leveraging ML/AI capabilities to ensure pertinent data sources are onboarded and adequately parsed.\n\nOffensive Security & Vulnerability ManagementPlan and conduct internal penetration tests and vulnerability assessments across applications, networks, and cloud environments.\nDemonstrate hands-on exploitation ability against common web vulnerabilities (e.g., SQL injection, XSS) to validate and clearly communicate findings - not just relying on scanner output.revised\nManually triage and identify complex or obfuscated attack patterns within raw log/SIEM data, beyond what pre-built alerts surface.revised\nPerform red-team-style exercises and adversary simulation to validate detection and response capabilities, translating findings into concrete remediation and detection improvements.\nDrive enterprise-wide vulnerability and configuration management, prioritizing and pushing remediation based on exploitability and business risk.revised\nCoordinate and/or manage third-party penetration tests and bug bounty engagements, tracking findings through to closure.\nConduct structured threat modeling on new features, services, and architecture changes to proactively identify attack surfaces and prioritize testing and remediation.revised\nIdentify, assess, and mitigate emerging AI risks, with a specific focus on vulnerabilities related to cloud-based AI services and agent-based AI architectures.\n\nSecurity Engineering & Infrastructure Hardening - supporting skillset, not the primary focusManage and secure cloud environments, using cloud firewalls and endpoint/CSPM platforms, informed by findings from testing and monitoring.\nDeploy and maintain Zero Trust Architecture (ZTA).\nAdminister edge protections, including DDoS mitigation, WAF, and CDN configurations.\nIntegrate and manage security within the CI/CD pipeline, including DAST, SAST, and SCA.\nSecure the software development lifecycle by integrating and managing scanning and repository tools.\nManage and secure containerized environments, ensuring safe image builds, dependency management, and secure deployments.\nSecure user SaaS-based tools (Google Workspace, Atlassian, Slack), Mac-based MDM, and DNS/mail security.\n\nAutomation, Documentation & LeadershipContinually leverage generative AI, scripting, and Infrastructure as Code (IaC) across all tasks - from incident triage to exploit/test tooling to playbook creation to reduce manual toil and scale security operations.\nManage the development of security documents, such as incident playbooks and security operations procedures.\nDevelop and exercise attack/defense playbooks (tabletop exercises, purple-team drills), keeping all security operations documents up to date.\nLead and mentor junior personnel within the security team.\n\nSkills & Experience RequiredStrong written and verbal English communication skills, with a proven ability to break down intricate security risks and procedures for both technical and non-technical audiences.\nDegree in information technology, computer science, cybersecurity, or a related field.\n5+ years of experience in security analysis, penetration testing, incident response, or a related field - with demonstrated hands-on offensive security experience (internal pentesting, red-teaming, or vulnerability research).\nDemonstrated, hands-on ability to identify and exploit common web application vulnerabilities (e.g., SQL injection, XSS) in a live setting comfort working directly against a target, not just running automated tools.revised\nProven ability to manually read and interpret raw log/SIEM data to spot sophisticated or obfuscated attacker activity, not solely alert-driven triage.revised\nOSCP required or in progress (or equivalent demonstrated offensive security capability); CISSP, CISM, or GCIH also valued.\nAWS Security Certification or equivalent experience.\nIn-depth knowledge of security principles, attacker TTPs (e.g., MITRE ATT&CK), and common vulnerability classes (OWASP Top 10, etc.).\nStrong understanding of network protocols, operating systems, and how to exploit and defend common misconfigurations.\nWorking knowledge of Infrastructure as Code (IaC), scripting/automation, and modern AI assistants to streamline security workflows, testing, and incident response fluent enough to assess and harden IaC, not necessarily its primary builder.\nFamiliarity with containerization and orchestration platforms (Kubernetes, Helm, Docker) and secure image/dependency management practices.\nKnowledge of security frameworks and standards, such as NIST, ISO 27001, and CIS Controls.\nFamiliarity with regulatory requirements, such as PCI DSS and GDPR.\nPractical experience applying structured threat modeling approaches to assess risk and prioritize security testing.revised\nUnderstanding of the threat landscape surrounding AI technologies, specifically evaluating and securing cloud and agent-based models.\nStrong analytical and problem-solving skills, paired with excellent communication and collaboration abilities.\n\nTechnology Stack\nExperience with equivalent or similar tools is completely acceptable.\nOffensive / testing - Burp Suite, Metasploit, Nmap, Cobalt Strike (or similar C2/pentest frameworks), Nessus / TenableIO\nLogging & SIEM - Splunk\nCloud & endpoint - CrowdStrike (Host and CSPM), AWS Security, Cloud Firewalls (AWS/Fortinet)\nAutomation & IaC - Terraform, CloudFormation, Ansible, or similar; scripting in Python/Bash\nContainers - Kubernetes, Helm, Docker\nPipeline security - Sonarcloud, Snyk, GitHub, Quay, Artifactory\nNetwork & edge - Cloudflare/CloudFront (DDoS, WAF, CDN), ZScaler (ZTA)\nVuln management - TenableIO, Snyk, Artifactory\nSaaS & email -Proofpoint, Google Workspace, Atlassian, Slack\nDevice mgmt - Mac-based MDM (JAMF or Kandji)\nWhy Work With Us?\nVisionary Team, Proven Results\nOur leadership bench brings deep, collective experiencein scaling high-growth FinTech companies through major funding cycles and critical market inflection points. This expertise creates a stable foundation, allowing you to focus on building and innovating. You will benefit directly from mentorship, expand your professional network, and learn the strategic decision-making processes required to lead a global, mature technology company.\nAccelerated Career Ownership & DEI Commitment\nWe are an emerging high-growth company, and that means your career trajectory here is accelerated. Our employees are immediately given a high level of ownership and autonomy over complex, impactful projects.\nAs FISPAN continues to grow, we are committed to celebrating diversity, endorsing equity, and encouraging inclusion. We strive to eliminate bias throughout our recruitment process and build a culture where everyone feels they belong and can contribute their best work.\nStrategic Total Rewards & Wellbeing\nWe invest in your success. Our total compensation packages are designed to be highly competitive, including a semi-annual bonus plan that give you a true stake in our future. Beyond your compensation, you benefit from:\nBest-in-Class Equipment: The most modern MacBook and Apple equipment.\nPrime Location: Our downtown Vancouver office offers coastal views and access to the building fitness center.\nFlexibility: Generous benefits, including a family leave top-up program and our Work-From-Anywhere policy.\nPurpose-Driven Culture & Prime Perks\nOur culture is the foundation of our success. We operate with a \"we over me\" mentality, fostering strong, collaborative bonds built on Trust and Candor. You will also enjoy: fully stocked cupboards, weekly catered team lunches, and daily JJ Bean coffee runs to keep your energy high and your wallet happy.\nCompensation Package\nFISPAN believes in an atmosphere and culture when innovation can flourish, collaboration and teamwork are valued and transparency is at the core of it all. We want our employees to see how the ideas they help generate today have an impact on how we do business tomorrow. With that, the hiring salary range for this position is $130,000-$160,000 CAD annually; the base pay offered is based on comparable market data from companies of similar employee size, revenue and location. As part of our total rewards offering, permanent employees in this position may be eligible for our competitive semi-annual bonus program, subject to program eligibility requirements.\nAt FISPAN, we reward employees for achieving their objectives, going beyond the requirements of their job, demonstrating leadership, fostering innovation and advancing the organization as a whole. We value talented people of all backgrounds and characteristics that share our vision of being the number one platform for the business banking ecosystem.\nOther components of our rewards offerings include support of career development, wellbeing, and personal growth.\nExtended health and dental benefits\nPaid time off\nSavings and retirement plan matching\nParenthood top-up\nMentorship programs, and leadership series (to name a few)\nNote: The incentive programs, benefits, and perks have certain eligibility requirements and may vary, only be partially or not at all available based on criteria such as location, employment status, etc. We’ll be happy to clarify eligibility for interviewing candidates.","description_format":"text","description_chars":11724,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Upper-Intermediate (B2)","optional":false}]},"benefits":["Apple Macbook","Equity","Parental leave","Retirement plans"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Financial Software & Embedded Finance","Integration & API Management"],"lifecycle":[{"event":"open","at":"2026-05-05T00:00:00Z"}],"visa":[{"country":"CA","licensed_sponsor":true,"evidence":"Positions approved through LMIA in 12 months: 2","filings_12m":2,"filings_prev_12m":2,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"Global Talent Stream","cap_exempt":false,"checked_at":"2026-10-03T21:10:52+00:00","sources":["ESDC: employers issued a positive LMIA"],"filings_for_role_12m":0}],"liveness":{"score":17,"band":"cold","label":"Long shot","p_open":1,"p_active":0.597,"p_room":0.28,"age_days":165,"expected_fill_days":71,"reasons":["conf:1","win:tail","crowd:"],"computed_at":"2026-10-17T05:46:00Z"},"pay":{"stated_usd_annual":115787,"is_top_pay":false},"html_url":"https://alion.io/job/fispan-senior-security-engineer","json_url":"https://alion.io/job/fispan-senior-security-engineer.json","meta":{"generated_at":"2026-10-17T15:55:37Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":21605,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":10164},"rest":"https://alion.io/mcp/rest/get_company?id=10164"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ffispan-senior-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ffispan-senior-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ffispan-senior-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/fispan-senior-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ffispan-senior-security-engineer"}]}