Security DevOps Engineer

Job Title: Security DevOps Engineer

Department: Infrastructure and Security

Type: Full-time

Reports to: Head of Infrastructure and Security

Salary Range: $100,000–$150,000 per year

Vacancy: This posting is for an existing vacancy.

Artificial intelligence: EnStream may use artificial intelligence-enabled tools to assist in screening or assessing applications for this position. Hiring decisions are made by EnStream personnel.

This role requires a minimum of four (4) days per week working onsite at EnStream’s head office in Toronto; this requirement may be changed at management’s discretion.

Who is EnStream

EnStream is a leader in secure digital identity and mobile data intelligence, working to advance the future of digital trust in Canada. We build innovative data-driven models that enhance the integrity, reliability, and safety of digital identity ecosystems.

Our mission is to empower frictionless trust in every interaction. EnStream is dedicated to increasing trust and convenience for Canadians using real-life, verified identities and network data held by trusted telco networks. At EnStream, every team member plays a critical role in shaping our strategy and delivering meaningful impact across industries.

About the Role

EnStream is seeking a Security DevOps Engineer to join our team as a full-time, hands-on engineer who splits their time evenly between cloud security and DevOps. Working alongside our Senior Platform Engineer, this role strengthens EnStream’s hybrid operating model by owning the security posture of our AWS environment while building and running the pipelines and automation that ship our identity platform.

You will embed security into every layer of how we build and operate: CI/CD, Infrastructure as Code, IAM, network controls, and vulnerability management. Because our platform serves Canada’s major banks and carriers, you will also help us meet and evidence our regulatory and compliance obligations.

This is a hands-on individual contributor role with direct impact on the security, reliability, and delivery speed of our platform.

What You’ll Do

Cloud Security Posture

• Own day-to-day cloud security posture across AWS: GuardDuty, Security Hub, WAF, CloudTrail, KMS, and Secrets Manager.
• Design and enforce IAM least-privilege policies, role structures, and periodic access reviews.
• Harden EC2, ECS, and RDS workloads and base images against CIS benchmarks; own the patch management cadence.
• Maintain security policies on Palo Alto (or equivalent) virtual firewalls in partnership with the Platform Engineer.

Vulnerability Management & Security Operations

• Run the vulnerability management program: scan, triage, prioritize, and track remediation with engineering teams.
• Serve as the security escalation point from our managed NOC/SOC provider; lead investigation and response for security incidents.
• Tune detections and alerts to reduce noise and improve signal.
• Coordinate penetration tests and track findings through to closure.

Governance & Compliance

• Support security assessments and compliance requests from our bank and carrier partners, as well as Canadian privacy obligations such as PIPEDA.
• Automate audit evidence collection; maintain security policies, standards, and runbooks.
• Perform security reviews and threat modeling for new features, vendors, and architecture changes.

CI/CD & DevSecOps

• Build and operate CI/CD pipelines using GitHub Actions, CodePipeline, or equivalent.
• Integrate security gates into pipelines: SAST, dependency scanning (SCA), container image scanning, IaC scanning, and secret detection.
• Enable developers with secure defaults, reusable pipeline templates, and practical guidance.

Infrastructure & Operations

• Build and maintain infrastructure with Terraform (preferred) or AWS CDK, following team IaC and GitOps standards.
• Operate containerized workloads on ECS; support deployments, scaling, and releases.
• Maintain monitoring, logging, and alerting with CloudWatch, Grafana, or equivalent, including centralized security logging.
• Share L2/L3 support and the on-call rotation with the Platform Engineer; contribute to post-mortems.
• Automate repetitive operational and security tasks with Bash or Python.

What You Bring

Must-Have

• 5+ years in DevOps, cloud, or infrastructure roles, including at least 2 years with a strong cloud security focus.
• Hands-on production AWS experience, including GuardDuty, Security Hub, IAM, KMS, and Secrets Manager.
• Experience building CI/CD pipelines and integrating security tooling (e.g., Snyk, Trivy, Semgrep, Checkov, or SonarQube).
• Strong IaC proficiency: Terraform (preferred) or AWS CDK/CloudFormation.
• Container experience in production: ECS or EKS.
• Solid Linux systems administration and scripting (Bash, Python).
• Working knowledge of networking and security fundamentals: VPCs, security groups, TLS, DNS, and firewall rules.
• Experience with vulnerability management and security incident response.
• Strong written communication; able to explain risk to engineers and leadership and produce runbooks and post-mortems.

Nice-to-Have

• AWS Certified Security Specialty is a strong plus; other security certifications such as CKS, CISSP, or CCSP are also welcome.
• Experience administering Palo Alto or other virtual firewalls.
• Experience supporting security audits or customer security assessments.
• Background in regulated industries: fintech, telecom, identity, or financial services.
• Experience working with an MSSP or managed NOC/SOC provider.
• Familiarity with Nginx, SIEM platforms, or policy as code (OPA, Kyverno).

Why Join Us?

• Contribute to a national-scale initiative defining the future of digital trust in Canada.
• Direct ownership of the security of critical infrastructure serving Canada’s major banks and carriers.
• A full-time, long-term role with real technical ownership at a growing, cloud-native company.
• Lean team where your decisions carry weight from day one; no bureaucracy, no ticket queues.
• Hybrid work model, flexibility with meaningful in-office collaboration.
• Professional development budget and certification support.