{"id":1682429,"url":"https://alion.io/job/questrade-security-engineer","title":"Security Engineer","company":{"id":58127,"name":"Questrade","domain":"questrade.com","url":"https://alion.io/company/questrade","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Dayforce","truth_index":{"grade":"A","score":95,"open_postings":13,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":67,"computed_at":"2026-10-15T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["North York, Canada"],"countries":["CA"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":115000,"max":130000,"currency":"CAD","period":"year","gross":null,"usd_annual":91320},"salary_estimate":null,"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agentic Workflows","optional":false},{"name":"AI Agents","optional":false},{"name":"Ansible","optional":false},{"name":"AWS","optional":false},{"name":"Bash","optional":false},{"name":"C#","optional":false},{"name":"C++","optional":false},{"name":"CI/CD","optional":false},{"name":"Claude","optional":false},{"name":"CloudFormation","optional":false},{"name":"Copilot","optional":false},{"name":"Cursor","optional":false},{"name":"GCP","optional":false},{"name":"Git","optional":false},{"name":"GitLab CI","optional":false},{"name":"Go","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"Java","optional":false},{"name":"NIST CSF","optional":false},{"name":"Python","optional":false},{"name":"Rust","optional":false},{"name":"SOC 2","optional":false},{"name":"Terraform","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-09-30T04:00:00Z","employer_posted_date":"2026-10-02","last_verified_at":"2026-10-15T11:13:47Z","board_verified":true,"closed_at":null,"days_open":15,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":15},"description":"What’s in it for you as an employee of QFG?\nHealth & wellbeing resources and programs \nPaid vacation, personal, and sick days for work-life balance\nCompetitive compensation and benefits packages\nWork-life balance in a hybrid environment with at least 3 days in office\nCareer growth and development opportunities\nOpportunities to contribute to community causes\nWork with diverse team members in an inclusive and collaborative environment\n\nThis job posting is for an existing vacancy.\n\nWe’re looking for our next Security Engineer. Could It Be You?\nThe Security Engineer is a hands-on application security engineer within the DevSecOps team. This role investigates how applications work, identifies vulnerabilities through source code review and manual testing, assesses design risks, and works with developers to implement and verify fixes. Success is measured by a demonstrable reduction in exploitable weaknesses across the software portfolio. The role requires practical development experience and the ability to investigate security issues independently, with scanners, SaaS platforms, and automation supporting the underlying engineering work.\n\nNeed more details? Keep reading…\nIn this role, responsibilities include but are not limited to: \nSecure Code Review: Reviewing application source code and tracing untrusted input across APIs, services, and data stores. Identifying root causes of authorization, injection, cryptographic, and secrets management flaws, including issues that automated scanners miss.\nThreat Modeling and Secure Design: Working with developers to map data flows, trust boundaries, and abuse cases for new features and integrations. Evaluating authentication, session management, authorization, and sensitive data handling, and translating risks into concrete design changes and testable security requirements.\nApplication Security Testing: Manually testing web applications and APIs for access control failures, cross-tenant data exposure, and business logic abuse. Using intercepting proxies, debuggers, and targeted test code to reproduce weaknesses in controlled environments and assessing their impact. Investigating relevant cloud, container, and IaC configurations when they contribute to an application attack path.\nVulnerability Investigation and Remediation: Investigating issues from manual reviews, testing, and scanners; establishing root cause, reachability, and exploitability. Producing reproducible evidence, contributing fixes with developers, and writing regression tests that demonstrate the vulnerable behavior is blocked without breaking intended functionality.\nSecurity Automation and Supply Chain: Turning recurring vulnerability patterns into reusable tests, custom detection rules, and GitLab CI/CD checks. Using SAST, DAST, SCA, and secrets scanning to extend review coverage, and assess dependency exposure using SBOMs and code paths. Validating build and artifact integrity, tuning tools and merge request gates to support reliable engineering decisions.\nDeveloper Collaboration: Explaining vulnerabilities using affected code, reproduction steps, and practical remediation options. Pairing with engineers on fixes, reviewing security-sensitive changes, and sharing secure coding patterns that prevent recurring defects.\nAI Application Security: Assessing AI-integrated features and agentic workflows for prompt injection, sensitive data exposure, and unsafe tool permissions. Developing targeted abuse cases and validating authorization and isolation controls with application developers.\n\nSo are YOU our next Security Engineer? You are if you…\nHold a Bachelor's degree in Computer Science, Software Engineering, Cybersecurity, or a related technical field\nHave 2-4 years of experience in application security or security engineering with substantial hands-on application security work, including independently investigating vulnerabilities and working with developers on remediation\nHave practical knowledge of HTTP/TLS, authentication and session handling, authorization, databases, and service-to-service communication in enterprise applications\nHave the ability to trace behavior using code, logs, and Linux/Windows tools, and assess how cloud IAM, networking, containers, and IaC affect application security\nHave meaningful hands-on software development experience in one or more languages such as C#, C++, Rust, Java, or Go with the ability to build, run, debug, and modify an existing codebase; trace API and data flows; and submit fixes with regression tests through Git-based code review\nHave practical understanding of injection, authorization, cryptographic, and business logic flaws, plus language-specific risks such as memory safety, where applicable\nHave hands-on experience with manual web/API security testing, intercepting proxies, and debugging, plus the ability to validate SAST, DAST, SCA, and secrets scanner findings against actual application behavior\nHave proficiency in Python or Bash to develop targeted security tests, reproduction scripts, and maintainable automation\nHave experience threat modeling application features and translating abuse cases into design changes and security tests with practical understanding of dependency risk, package managers, SBOMs, as well as build and artifact integrity\nHave working knowledge of AI and agentic security risks\nHave experience using AI coding assistants (e.g., Copilot, Cursor, Claude) to accelerate security reviews, remediation work, and the development of scripts, test cases, and custom tooling\nHave the ability to independently explain, debug, and test AI-generated code and remediation suggestions, verifying correctness and security against the actual codebase before adopting them\nHave excellent communication skills with the ability to independently explain technical concepts to different teams\n\nAdditional kudos if you…\nHave experience authoring reusable infrastructure and configuration automation with tools such as Terraform, Ansible, or CloudFormation\nHave experience with security frameworks such as NIST CSF, NIST SSDF, ISO 27001, or SOC 2\nHave relevant security certifications (CompTIA Security+, AWS Certified Security – Specialty, GCP Professional Cloud Security Engineer, or equivalents)\nHave experience with incident response and security investigations\n\nCompensation Information:\nBase salary range: $115,000 - $130,000\nThe final compensation package will be commensurate with the successful candidate's experience, skills, and geographic location (Canada). It includes a comprehensive benefits plan and a competitive incentive (bonus) program for Full-Time Permanent roles.\n\nSounds like you? Click below to apply!\n#LI-NP1","description_format":"text","description_chars":6677,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Investing Apps & Robo-Advisors","Online Brokerage & Trading Platforms"],"lifecycle":[{"event":"open","at":"2026-10-02T09:49:19Z"}],"visa":[],"liveness":{"score":89,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.886,"p_room":1,"age_days":15,"expected_fill_days":67,"reasons":["conf:3","velocity","win:early","comp:junior"],"computed_at":"2026-10-15T05:46:00Z"},"pay":{"stated_usd_annual":91320,"is_top_pay":false},"html_url":"https://alion.io/job/questrade-security-engineer","json_url":"https://alion.io/job/questrade-security-engineer.json","meta":{"generated_at":"2026-10-15T13:51:04Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":21333,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":58127},"rest":"https://alion.io/mcp/rest/get_company?id=58127"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fquestrade-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fquestrade-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fquestrade-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/questrade-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fquestrade-security-engineer"}]}