Site Reliability Engineer - Application Security

ContactMonkey Inc.; Toronto; Híbrido; CAD 130.000 - 150.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Employer-paid benefits

Health Spending Account

Stock options

Work from anywhere in the world (up to

Personal day + volunteering days

Birthday off

Health days

Downtown Toronto office (hybrid)

Descripción de la vacante

ContactMonkey is seeking an experienced Site Reliability Engineer focused on application security to maintain and secure our AWS/Kubernetes infrastructure. You will work with SRE and development teams to run production systems, improve deployments, and address security risks while aligning with SOC 2 and GDPR controls.

You will help build AI-assisted, scalable workflows, monitor incidents, and support CI/CD automation.

Formación

• 5+ years in SRE, DevOps, platform engineering, cloud ops, or related role.
• Experience writing Terraform modules and Terragrunt config, reviewing plans, remote state.
• Experience with Docker and Kubernetes, including troubleshooting deployments.
• Solid understanding of Linux, networking, DNS, HTTP, TLS.
• Experience with Git, CI/CD pipelines, and deployment workflows.
• Experience using logs, metrics, dashboards, alerts to investigate production problems.
• Practical application security experience through vulnerability remediation, secure code review, threat modelling, or security tooling.
• Understanding of web app risks (broken access, injections, auth weaknesses, data exposure).
• Familiarity with IAM, least privilege, secrets management, encryption.
• SOC 2 controls and GDPR principles relevant to engineering.
• Clear communication and good judgment for independent work or escalation.

Responsabilidades

• Maintain AWS and Kubernetes environments, troubleshoot production issues, improve availability and resource usage.
• Build and maintain infrastructure as code with Terraform/Terragrunt, review plans, manage environment configuration.
• Improve CI/CD pipelines, deployment automation, release checks, and rollback procedures.
• Improve monitoring and incident handling; participate in on-call rotation and incident reviews.
• Work with developers to assess vulnerabilities and validate fixes.
• Maintain security scanning for code, dependencies, secrets, containers, and infrastructure.
• Strengthen IAM, secrets management, network controls, and Kubernetes security.
• Support SOC 2 audits, audit evidence, and personal data protection.
• Test backups and recovery procedures, maintain runbooks, support production readiness.
• Collaborate through code reviews, documentation, and cross-team support.

Conocimientos

SRE/DevOps

Terraform

Terragrunt

Docker

Kubernetes

Linux basics

Networking

HTTP TLS

CI/CD

Monitoring

App security

SOC2/GDPR

Communication

Herramientas

AWS

Kubernetes (EKS)

Terraform

Terragrunt

GitHub Actions

Prometheus

Grafana

CloudWatch

Descripción del empleo

Site Reliability Engineer - Application Security

Toronto

Join us as we push engineering forward in a world that’s changing fast. You’ll help us evolve how we build, deploy, and secure software. Embracing new technologies, challenging the status quo, and finding better ways to ship faster without compromising reliability or security. Working closely with our SRE and development teams, you’ll help run and improve our production infrastructure, streamline deployments, investigate production issues, and address security risks. You’ll also help build the technical controls that support SOC 2 audits and GDPR compliance. We’re excited to work with someone who’s curious about what’s next, passionate about continuous improvement, and motivated to turn new ideas into real engineering progress.

Our north star: Become an AI-first engineering team. AI coding agents are a core part of how we build and operate. We use them to write and review Terraform, debug incidents, automate repetitive operational work, and move faster without lowering the bar on quality or security. We’re looking for someone who already works this way, or is excited to: someone who knows how to direct an agent well, check its output with a critical eye, and spot where AI can remove toil from our infrastructure and security workflows. You’ll also help shape how we use AI safely, including guardrails, access controls, and keeping sensitive data protected.

Our environment includes AWS, Kubernetes on EKS, Terraform, Terragrunt, GitHub Actions, Prometheus, Grafana, and CloudWatch. Our applications use Ruby on Rails, Vue.js, and Node.js, with MySQL, PostgreSQL, and Sidekiq supporting the backend.

Your impact

• Infrastructure & reliability: Maintain AWS and Kubernetes environments, troubleshoot production issues, and improve availability, performance, and resource usage.
• Terraform & Terragrunt: Build and maintain infrastructure as code, review plans, manage environment configuration, and address infrastructure drift.
• Deployments & developer experience: Improve CI/CD pipelines, deployment automation, release checks, and rollback procedures.
• Monitoring & incidents: Improve monitoring and alerts, join the on-call rotation, and contribute to incident reviews.
• Application security: Work with developers to assess vulnerabilities, review security risks, and validate fixes.
• CI/CD security: Maintain code, dependency, secrets, container, and infrastructure scanning.
• Cloud security: Strengthen IAM, secrets management, network controls, and Kubernetes security.
• SOC 2 & GDPR: Support technical controls, audit evidence, and personal data protection.
• Recovery: Test backups and recovery procedures, maintain runbooks, and support production readiness.
• Collaboration: Participate in code reviews, document changes, and support application, AI, and data engineering teams.

About you

• Around 5+ years of experience in SRE, DevOps, platform engineering, cloud operations, or a related engineering role. Equivalent practical experience is welcome.
• Experience writing and maintaining Terraform modules and Terragrunt configuration, including reviewing plans and working with remote state.
• Experience with Docker and Kubernetes, including troubleshooting deployments, services, health checks, and resource limits.
• A solid understanding of Linux, networking, DNS, HTTP, and TLS.
• Experience with Git, pull requests, CI/CD pipelines, and deployment workflows.
• Experience using logs, metrics, dashboards, and alerts to investigate production problems.
• Practical application security experience through vulnerability remediation, secure code review, threat modelling, or security tooling.
• Understanding of common web application risks, including broken access control, injection, authentication weaknesses, and sensitive data exposure.
• Familiarity with IAM, least privilege, secrets management, and encryption.
• Working knowledge of SOC 2 controls and GDPR principles relevant to engineering, including access restrictions, data minimization, retention, and deletion.
• Clear communication skills and good judgment about when to work independently, request a review, or elevate an issue.

How you can stand out

• Experience at a start up or scale up
• Supported Ruby on Rails or Node.js applications in production
• Worked with MySQL, PostgreSQL, Redis or Valkey, and Sidekiq
• Experience with GitHub Actions, Argo CD, Helm, Karpenter, or KEDA
• Built useful monitoring with Prometheus, Grafana, or CloudWatch
• Supported services across multiple AWS regions
• Helped remediate penetration-test findings or contributed technical evidence to a SOC 2 audit
• Participated in backup restoration or disaster recovery exercises.
• Familiar with securing AI integrations, agent workloads, or MCP services
• You hold relevant AWS, Kubernetes, Terraform, or security certifications.

Working with the team

You'll work closely with SRE and application engineers, and support AI and data initiatives where they depend on shared infrastructure.

We value people who ask questions, explain their reasoning, and leave systems easier for others to understand. You'll take part in technical discussions and code reviews, share what you learn, and help improve how we operate.

Reducing recurring incidents, unnecessary alerts, and repetitive manual work is part of the role. We want reliable systems and sustainable operations for the people supporting them.

What we bring to the table

• 100% employer-paid benefits and a Health Spending Account from day one
• Work from anywhere in the world for up to four weeks
• A stock option plan so you can own a piece of our success
• One personal day and two volunteering days
• Your birthday off
• Five health days per year
• A downtown Toronto office for hybrid work, with plenty of snacks

Compensation and work details

The salary range for this role is $130,000-$150,000 Compensation is based on experience, skills, and our internal compensation framework and equity. We're happy to discuss compensation throughout the hiring process. This is a full-time position on our SRE team.

The role includes a shared on-call rotation after onboarding. We'll discuss the schedule, escalation support, and expectations during the interview process.

Who we are

We're a team of curious, driven people changing how companies talk to their employees. Brands like Pepsi, Adidas, Panasonic, Dyson and many more use ContactMonkey to make internal comms go from ignored to engaged.

Our all-in-one platform lets teams build, send and measure internal emails right from Outlook or Gmail, with a drag-and-drop email builder, engagement tools and analytics that show what's actually landing. The result? More opens, more clicks and more conversations.

We've been growing fast, and we're just getting started:

• Ranked by the Globe and Mail as one of Canada's fastest-growing companies
• Named to the Deloitte Technology Fast 50™ in 2023, 2024 and 2025
• Named to the Deloitte Technology Fast 500™ in 2023, 2024 and 2025 as one of North America's fastest-growing companies
• Raised a $55M Series A in 2023

We build products for diverse workplaces, and the best way to do that is with a diverse team. We strongly encourage applications from everyone, regardless of race, religion, colour, national origin, gender, sexual orientation, age, marital status or disability status.

We want every candidate to have a great, accessible experience. If you need any accommodations or adjustments during the interview process or beyond, just let us know and we'll make sure the right support is in place. We're always working to improve, so we welcome your feedback, too.

We use AI to take notes during interviews. All applications and interviews are reviewed by real humans on our Talent Acquisition team. Our applicant tracking system uses AI to help with workflows and keep the hiring process running smoothly.

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in aconfidential file.

As set forth in ContactMonkey’s Equal Employment Opportunity policy,we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection. As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categoriesis as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.