DevSecOps Platform Specialist

DevSecOps Platform Specialist (Senior)

Cybersecurity · Quebec City or Montreal · Hybrid

What you’ll come do with us

You’re the person who builds the security tool and uses it. Instead of launching a scan, exporting a 400-finding PDF and wishing the devs good luck, you sort out what’s real, you set aside the false positives and you show the team how to fix the rest. Half of your time, you do application security on Vooban’s projects. The other half, you develop the security platform we’re building in-house: you see a finding we still triage by hand, you automate it; you see a blurry trust boundary, you model it and close it. You work hand in hand with our devs and the cyber team, not from an ivory tower.

The platform brings together in one place threat modeling, a security graph, system composition analysis, vulnerability triage and compliance tracking, with AI agents that do a good part of the analysis in the background. Nobody is going to hand you a neatly wrapped ticket: you take ownership of a feature, from the data model to the interface, and you decide how to secure it. It’s an environment made for people who prefer proving that a control works rather than claiming that it exists. And it’s a rare role, where full-stack, security, platform and applied AI often intersect in the same merge request.

Pssst: we mostly work remotely, but you must be able to come by our Quebec City or Montreal offices when needed.

What you’ll drive with us

• Project application security. You analyze the code of Vooban’s projects with tools like Wiz or Snyk, you separate real risks from noise and you give teams clear instructions to fix them.
• End-to-end delivery. You take a platform feature from the data model to the interface, through the API, with access decisions settled at every step. Strict TypeScript, React, PostgreSQL and a contract-first API.
• Guardian of the platform’s posture. Threat modeling, authorization that fails closed, strict data isolation between clients, secrets that never end up in a log. It’s a security product; its guarantees are the heart of the game.
• Drama-free cloud operations. Infra as code, GitOps on Kubernetes, continuous delivery gated by quality checks, observability. You favour safe, reversible changes, and a rollback that doesn’t make anyone sweat.
• A supply chain that holds up. Signed images, SBOM, provenance and policies tested like code. You can prove that what runs in prod is indeed what the CI built.
• Well-governed AI agents. You design the agents that do security analysis in the background and the guardrails around them: secret-free sandbox, inputs treated as hostile, validated outputs. With us, scanners decide the truth and LLMs do the triage.
• Concrete governance. You connect what the code actually does to recognized frameworks (NIST CSF, SOC 2, ISO 27001) and to the evidence they require.
• A system that stays understandable. Recorded decisions, accurate docs, tests that prove intent. A lesson learned becomes a test or a lint rule, not a forgotten paragraph in a wiki.

Your profile

• At least 5 years in software development, including 2 or more years in application security, DevSecOps or cloud operations.
• Serious full-stack work in a typed language: data model, API and interface, with code others want to maintain.
• Hands-on experience with code security tools (Wiz, Snyk or the equivalent). You can recognize a false positive and explain to a team why the other finding, on the other hand, is urgent.
• Solid foundations in identity and access, threat modeling, and data and secrets protection.
• Experience deploying and operating containerized services, with infrastructure defined as code.
• A bachelor’s degree in software engineering or computer science. Learned another way and you build solid software? Show us what you’ve done.
• You already use AI in your daily work, and you have an opinion on what it does well and less well.
• French and English at work, both spoken and written.
• A background at a product company or in an organization where you touched the whole cycle, not just one small piece (an asset).
• LLMs or AI agents in production, sandboxing, GitOps, multi-cloud, cryptography or SOC 2 / ISO 27001 control mapping (an asset).
• OSCP, GSEC, CISSP, or a track record in CTFs or security research (an asset).