Information Security Engineer (DevSecOps)

Equinix, Inc; Canada; On-site; CAD 90,000 - 130,000; Full time

Job summary

Equinix, Inc. is seeking an Application Security Engineer to strengthen and continuously improve the security posture of its applications. You will embed security into the SDLC, automate tests in CI/CD, and drive remediation of vulnerabilities.

You will partner with engineering teams to perform design reviews, triage findings, and promote secure coding and threat modeling across the org. Strong collaboration across global teams is essential.

Qualifications

• Hands-on experience with SAST, SCA, Secret Scanning and DAST tooling and remediation.
• Experience integrating security tests into CI/CD pipelines (GitHub Actions).
• Strong knowledge of OWASP Top 10, API security, and secure SDLC practices.
• Ability to perform threat modeling (STRIDE, data flows) and reviews.
• Familiarity with cloud security across major providers.
• Ability to communicate risk and remediation clearly to developers.

Responsibilities

• Integrate and operate application security testing tools within the SDLC.
• Promote shift-left security and early vulnerability remediation.
• Lead design reviews and threat modeling with application teams.
• Prioritize findings, tune policies, and reduce false positives.
• Develop automation/scripts to onboard apps to security tooling.

Skills

SAST

SCA

DAST

Secret Scanning

GitHub Actions

Threat Modeling

OWASP Top 10

Cloud Security

Secure Coding

Education

Bachelor's degree preferred

Tools

Apiiro

Nexus IQ

Snyk

SonarQube

Semgrep

Burp Suite

Job description

Who are we?

Equinix is the world's digital infrastructure company®, shortening the path to connectivity to enable the innovations that enrich our work, life and planet.

A place where tech thinkers and future builders turn bold ideas into breakthrough experiences, we welcome your unique perspective.

Help us challenge assumptions, uncover bias, and remove barriers-because progress starts with fresh ideas. You'll find belonging, purpose, and a team that welcomes you-because when you feel valued, you're empowered to do your best work.

Job Summary

The Application Security Engineer will be responsible for strengthening and continuously improving the security posture of the organization's applications. This role involves integrating security into the software development lifecycle (SDLC), embedding and automating application security testing within CI/CD pipelines, and driving timely remediation of identified vulnerabilities.

The engineer will work closely with application teams to perform security design reviews, triage and assess vulnerabilities, and guide teams on effective remediation, security best practices, secure coding and threat modeling.

Success for this role requires that you are

• Familiar with application security concepts, standards and trends (OWASP Top 10, OWASP ASVS, secure SDLC)
• Able to interpret and apply security principles and standards to application designs, architectures, configurations and policies
• Able to automate security controls using pipeline-as-code and infrastructure-as-code
• Driven to learn new things; excited about challenges and finding solutions
• A strong builder mentality with a drive to "see things through"
• Able to communicate technical concepts, risk and remediation guidance clearly and concisely to developers, peers and management
• Able to demonstrate good judgment in prioritizing vulnerabilities based on their impact to the confidentiality, integrity and availability of information

Responsibilities

• Integrate, operate and continuously improve application security testing tools (SAST, SCA, Secret Scanning and DAST) within the SDLC
• Implement shift-left security practices to ensure vulnerabilities are detected and remediated early in the SDLC
• Conduct threat modeling, secure design reviews and architecture reviews with application teams to identify and mitigate risks early
• Triage, validate and prioritize findings from SAST, SCA, Secret Scanning and DAST; tune rules, policies and quality gates to reduce false positives
• Partner with application teams to remediate identified vulnerabilities by providing clear, actionable guidance and tracking findings through to closure
• Recommend and promote security best practices and secure coding standards, and educate developers on common vulnerability classes
• Build and maintain automation and scripts (e.g., Python, Terraform) to onboard applications to security tooling, enforce policy as code, and report on application security metrics
• Track and report on application security posture (e.g., vulnerability trends, remediation timelines, tool coverage) to stakeholders and management
• Model the Equinix culture and values

Knowledge / Skills / Abilities

• Hands-on experience with SAST, SCA, Secret Scanning and DAST tooling, including interpreting results and guiding remediation
• Hands-on experience with CI/CD tools such as GitHub Actions, including integrating security scans and quality gates into pipelines
• Strong understanding of the OWASP Top 10, OWASP API Security Top 10, OWASP ASVS and related standards (NIST, CIS Benchmarks) and the ability to recommend solutions aligned with them
• Hands-on experience performing threat modeling (e.g., STRIDE, data flow diagrams) and secure design reviews
• Understanding of AI and LLM security risks and mitigations (e.g., OWASP Top 10 for LLM Applications, prompt injection, data leakage, model and AI supply chain risks) and how to secure AI-enabled applications
• Working knowledge of common vulnerability classes (e.g., injection, XSS, SSRF, broken access control, insecure deserialization) and how to remediate them in code
• Working knowledge of securing applications built on public cloud services (any of the major cloud providers)
• Ability to partner with application teams to remediate vulnerabilities and adopt secure coding practices
• Demonstrated ability to work within globally dispersed and cross-functional teams

Qualifications

• 4-5 years of work experience in Application Security or DevSecOps in a medium or large corporate environment; a bachelor's degree in computer science, engineering or a related field is preferred
• Demonstrated hands-on experience with each of the following:
  • SCA (e.g., Apiiro, Nexus IQ, Snyk)
  • SAST (e.g., SonarQube, Semgrep)
  • Secret Scanning
  • DAST / API security (e.g., Traceable, Burp Suite)
  • Threat Modeling
  • GitHub Actions
  • Terraform
• Experience collaborating with application teams to suggest security best practices and remediate identified vulnerabilities

The targeted pay range for this p