Vecima Networks Inc. (TSX: VCM) builds the intelligent infrastructure powering the next generation of connectivity. Through broadband access, content delivery, cloud-native software, automation, and AI-enabled solutions, Vecima helps service providers modernize cable and fiber networks, deliver exceptional broadband and video experiences, and operate more intelligent, efficient networks. As operators evolve toward AI-enabled, software-driven architectures, Vecima’s platforms simplify operations, accelerate innovation, and enable the reliable, high-performance networks that connect homes, businesses, and communities around the world. Learn more at vecima.com.
About the role
We are looking for a Senior Security Software Engineer / Developer to work directly with our software and product engineering teams to design, build, test, release, and maintain well secured products.
This is a hands-on engineering role. You will work with Software Architects, Developers, Product Management, and Compliance to identify security risks, improve product architectures, investigate vulnerabilities, and build practical security capabilities into the product development lifecycle.
This role spans secure software design, threat modelling, embedded Linux, vulnerability analysis, software supply-chain security, SBOMs, security automation, and product security assurance.
You will not be operating a Security Operations Centre, administering corporate networks, or performing general corporate IT security. Your focus is Product Security: understanding how our products are designed and built, identifying how they could be attacked or fail, and working with engineering teams to reduce those risks.
We believe Product Security works best as an engineering partner rather than a final-stage approval function. You will help teams make good security decisions themselves, while providing deeper technical expertise where it is needed.
You do not need to be an expert in every technology or security discipline listed below. We are looking for strong engineering fundamentals, sound security judgement, curiosity, and the ability to investigate unfamiliar systems and learn quickly. You need to be willing to dig into the actual technology, understand how the product really works, question assumptions, and turn security problems into practical engineering solutions.
Customer interaction is a key part of the work – we need to be able to clearly describe our approach to Product Security, how we can address the changing threat landscape together, and work collaboratively with our service provider customers to achieve their security needs when deploying our products.
If that sounds like the kind of Product Security work you want to do, we'd like to hear from you.
What you will do
- Identify and reduce security risk throughout the product lifecycle, from early design through deployment, maintenance, and end of life.
- Lead threat modelling for new products, features, and significant architecture changes; identify assets, trust boundaries, attack surfaces, abuse cases, attack paths, and appropriate security controls.
- Review product architectures and security sensitive designs, including authentication, authorization, identity, credential management, cryptography, secure communications, audit logging, update mechanisms, secure defaults, and safe failure behaviour.
- Translate security risks into clear engineering requirements, implementation guidance, verification plans, and actionable work for development teams.
- Provide practical security leadership to software teams without becoming a central approval bottleneck. Coach developers and architects in secure design, secure coding, threat modelling, and security testing.
- Improve secure product development through risk-based activities, release criteria, reusable guidance, templates, security reviews, and automated CI/CD checks.
- Help teams apply defense in depth, least privilege, secure-by-default behaviour, and appropriate isolation boundaries across embedded software, Linux-based systems, distributed services, cloud-connected products, APIs, and management interfaces.
- Support Software Bill of Materials (SBoM) generation, validation, completeness, release integration, and disclosure using CycloneDX and related standards.
- Perform CVE monitoring and triage; support product vulnerability assessment, remediation, disclosure, customer communication, and Product Security Incident Response Team (PSIRT) practices.
- Lead the technical Product Security scoped contribution to the organization's full ISO/IEC 27001 Information Security Management System (ISMS), including applicable controls, procedures, and technical evidence.
- Lead customer engagement related to security reviews, questionnaires, contractual requirements, and audits with clear technical evidence.
What you bring
Engineering experience
- 5+ years of professional software engineering, security engineering, or a combination of both, with significant hands-on experience securing production software.
- Experience with Linux, source control, code review, build systems, CI/CD, automated testing, and modern software development practices.
- Ability to understand production software at the source-code level and work effectively with developers on security-sensitive changes.
- Programming ability in at least one relevant language, with experience working with languages such as C, C++, Python, Go, Java, JavaScript/TypeScript, or Rust.
Product Security experience
- Experience applying Product Security or Application Security practices within a software development organization.
- Strong understanding of secure software design, common vulnerability classes, attack techniques, and defensive controls.
- Practical threat modelling experience using STRIDE, attack trees, abuse cases, or an equivalent risk-based approach.
- Experience reviewing software or system architectures from a security perspective and translating identified risks into practical engineering requirements.
- Experience investigating vulnerabilities and determining technical impact, exploitability, affected components, and appropriate mitigations.
Systems & software supply chain
- Experience with SBOM and software composition analysis tools and familiarity with CycloneDX.
- Working knowledge of software dependencies, vulnerability databases, software supply-chain risk, and vulnerability remediation.
- Understanding of how software is built, packaged, released, deployed, and maintained in production environments.
Communication & leadership
- Ability to explain complex technical security risks clearly to developers, architects, product leaders, auditors, and customers.
- Sound engineering judgement, including the ability to balance risk reduction with product constraints, delivery requirements, reliability, performance, and long-term maintainability.
- Ability to lead through technical credibility, collaboration, coaching, and influence rather than organizational authority.
- Comfortable working across multiple engineering teams and helping teams solve security problems without becoming a central approval bottleneck.
- Comfortable developing and leading customer presentations and collaborative technical engagement describing our product security principles, integration of our products within their security infrastructure, and best practices for deployment and operation.
Nice to have
- Embedded Linux or Linux-based product development.
- Networking products, telecommunications, distributed systems, or cloud-connected appliances.
- Secure boot, trusted execution, hardware-backed identity, cryptographic key management, signed software updates, or device lifecycle security.
- Experience reproducing and investigating vulnerabilities hands-on.
- Static application security testing, dynamic application security testing, fuzzing, penetration testing, binary analysis, reverse engineering, or runtime security analysis.
- Experience analysing vulnerable source code, attack paths, proof-of-concept behaviour, or security mitigations.
- CycloneDX VEX, Common Security Advisory Framework (CSAF), SPDX, package URLs (purl), or Common Platform Enumeration (CPE).
- CVE, CVSS, CWE, CISA Known Exploited Vulnerabilities, vulnerability disclosure, or PSIRT processes.
- Experience improving the accuracy, completeness, or operational use of SBOM and vulnerability data.
- Experience with ISO/IEC 27001 controls and technical audit evidence in a product development environment.
- Familiarity with secure development frameworks or standards such as NIST SSDF, OWASP SAMM, IEC 62443, or related regulatory requirements.
- Experience improving a secure development programme across multiple products or engineering teams.
- Relevant security or software certifications.
Vecima Recruitment Process
Vecima takes great care to protect your privacy and personal information throughout the recruitment process.
All legitimate email communications and job offers will come from an @vecima.com email address. If you receive a suspicious message, please contact your Vecima representative directly to verify its legitimacy.
Submit your application
- Follow the application instructions carefully
- Complete all required fields and upload necessary documents
Initial Screening
- If shortlisted, you will receive an email or phone call from a Vecima HR Business Partner for:
- A brief conversation about your background
- Basic questions about availability, salary expectations, and interest in the role
Interviews
- Phone/Video Interviews: First round with HR or the hiring manager
- Technical/Skills Assessments: If applicable, complete a test or assignment
- In-Person or Final Interviews: Meet with hiring managers or team members; could be a panel
Reference & Background Checks
- Provide professional references upon request
- Be prepared for employment or education verification, and a criminal background check
Job Offer
- All job offers will come from Vecima’s UKG Applicant Tracking System
- Review the verbal and written offer carefully
Onboarding Preparation
- Complete paperwork and pre-employment requirements
- Get details on your first day, orientation, and whom to contact