Security Engineer: AI-Driven Secure DevOps

League Inc.; Toronto; Hybrid; CAD 109,000 - 136,000; Full time

Job summary

League’s security engineering team is focused on scaling security across the development lifecycle. This intermediate security engineer role balances engagement work with engineering, running security reviews, threat modeling, and building tooling to automate and secure pipelines.

You will contribute to secure design practices and communicate risk clearly to engineers and leadership while supporting SOC 2, HITRUST, HIPAA and PHIPA frameworks in a fast-growing AI-enabled environment.

Qualifications

• 2+ years of professional experience in application or product security, or software engineering with security responsibility.
• Ability to identify issues like broken access control, tenant isolation failures, and business logic flaws.
• Knowledge of authentication/authorization in modern apps (OAuth 2.0 / OIDC, tokens, RBAC/ABAC).
• Familiarity with CI/CD and software supply chain security, including dependency management and secrets handling.
• Solid understanding of OWASP Top 10 and mitigations.
• Experience with AI and LLM security, including prompt injection and retrieval pipeline exposure.
• Exposure to cloud security concepts, ideally GCP, including containerized workloads.
• Track record of writing and shipping code in Python, Go, or similar.

Responsibilities

• Conduct security reviews of product features, integrations, and platform changes, documenting security requirements.
• Participate in threat modeling exercises to identify risks in system design and data flow.
• Perform security assessments of applications, APIs, and cloud configurations with remediation guidance for engineering teams.
• Review AI-enabled product features for prompt injection and unintended data exposure.
• Triage and drive remediation of security findings with owning teams.
• Automate manual review efforts and embed security checks into the SDLC.
• Develop training materials on secure coding practices and common vulnerabilities.

Skills

Security reviews

Threat modeling

CI/CD security

Cloud security

Python/Go coding

OAuth 2.0 / OIDC

AI security

Vendors risk assessments

Tools

CI/CD pipelines

GCP

Job description

League’s security engineering team is focused on scaling security across the development lifecycle. This intermediate security engineer role balances engagement work with engineering, running security reviews, threat modeling, and building tooling to automate and secure pipelines.

You will contribute to secure design practices and communicate risk clearly to engineers and leadership while supporting SOC 2, HITRUST, HIPAA and PHIPA frameworks in a fast-growing AI-enabled environment.