Software Engineer – Security Remediation

Software Engineer – Security Remediation

Location: Saint-Laurent, Quebec, Canada

Work Model: Hybrid – 3 days onsite (Monday, Tuesday, and Thursday)

Contract Duration: Approximately 4 months

Language Requirements: Fluency in both English and French

Experience: 4+ years

Position Overview

We are seeking a skilled Software Engineer – Security Remediation (Level II) for a contract opportunity focused on addressing software security vulnerabilities across a portfolio of products.

This is a hands-on engineering role involving the identification, remediation, and verification of security findings directly in source code and through security tools. The successful candidate will work with existing codebases, resolve vulnerabilities efficiently, and ensure that all fixes meet established engineering quality standards and security requirements.

The ideal candidate will combine strong software development skills with practical security knowledge, sound technical judgment, and the ability to distinguish genuine vulnerabilities from false positives. The role also requires knowing when issues need to be escalated to internal engineering teams due to product-specific, safety-critical, or proprietary technical considerations.

Key Responsibilities

• Remediate software security findings across the product portfolio, including dependency vulnerabilities, static application security testing (SAST) findings, software composition analysis (SCA) issues, exposed secrets, and container base-image vulnerabilities.
• Identify and fix vulnerabilities directly in source code and through security remediation tools.
• Validate and verify that security findings have been genuinely resolved rather than suppressed or incorrectly closed.
• Analyze security scan results to distinguish exploitable vulnerabilities from false positives and document the rationale for closing non-issues.
• Identify and report inaccuracies or recurring issues within security scanning tools.
• Prioritize remediation activities based on exploitability, business impact, and potential security risks rather than severity ratings alone.
• Escalate findings that require specialized product knowledge, particularly those involving safety-critical systems, real-time processing, proprietary machine-vision algorithms, robotics, firmware, or embedded logic.
• Collaborate with engineering and security teams to ensure remediation activities align with established development practices and security standards.
• Follow Git-based development workflows, CI/CD security gates, code-signing requirements, and software supply-chain security controls.
• Support dependency upgrades, secrets removal and rotation, and updates to hardened container images.
• Maintain accurate records of remediation activities, document completed fixes, and report progress against the outstanding security backlog.
• Ensure that all changes maintain software stability, quality, and compliance with established engineering requirements.

Required Qualifications

• Bachelor's degree in Computer Science, Software Engineering, or a related field, or equivalent practical experience.
• Minimum of 4 years of professional software engineering experience.
• Strong programming skills in one or more of the following languages: C, C++, C#, Python, JavaScript, or TypeScript.
• Ability to understand, analyze, and work confidently within unfamiliar or complex codebases.
• Practical understanding of common software vulnerabilities, their potential impact, and appropriate remediation approaches.
• Hands-on experience with security scanning tools, including SAST, SCA, and secrets-scanning solutions.
• Experience managing software dependencies, applying security patches, and validating remediation results.
• Ability to analyze security findings, identify false positives, and determine which issues require further investigation or escalation.
• Familiarity with Git, source-code management, and CI/CD pipelines.
• Strong analytical, debugging, problem-solving, and documentation skills.
• Ability to communicate effectively in both English and French.
• Willingness to work onsite three days per week in Saint-Laurent, Quebec.

Preferred Qualifications

• Previous experience in software security remediation, application security (AppSec), or vulnerability management.
• Experience working with machine-vision, imaging, embedded systems, robotics, or firmware-related software.
• Familiarity with software supply-chain security practices and Software Bills of Materials (SBOMs).
• Experience with code signing, secure software delivery, and hardened container images.
• Knowledge of secure coding practices, vulnerability assessment, and software security best practices.
• Experience collaborating with cross-functional engineering and security teams in a product development environment.

Ideal Candidate Profile

The ideal candidate is a hands-on software engineer who can independently investigate and remediate security findings while maintaining high standards of code quality and product reliability. They should have practical experience with application security tools, strong programming fundamentals, and the judgment to resolve routine vulnerabilities while escalating complex issues that require specialized product knowledge.

• Candidates with a combination of software development, vulnerability remediation, and application security experience will be particularly well suited to this opportunity