Want to know if this job is worth applying to?
Toronto, Ontario, Canada
Onsite
Our Information Security team is seeking an experienced, hands-on Security Engineering Manager to lead the health, performance, and continuous improvement of our security tooling ecosystem and own the maturity of our Incident Response program.
This is an individual contributor role with no direct reports. The position focuses on technical leadership, security program ownership, and managing external security vendors and service providers rather than directly managing an internal team.
This role owns complex, cross-functional problems, including shaping how we secure user devices at scale, driving the performance of our Managed Detection and Response (MDR) partner, and ensuring the organization is prepared to respond to significant security events.
You will work closely with stakeholders across IT, Engineering, Cloud Operations, and business leadership to define and execute the endpoint security program roadmap, hold vendors accountable to defined service levels, and build organizational readiness through tabletop exercises, playbooks, and clear incident response procedures.
Endpoint Security Program Execution & Operations
Lead the healthy functioning of the security stack across endpoints, including EDR, DLP, ZTNA, PAM, and EPM, and drive continuous policy improvements across each.
Further mature and track health metrics for each tool (agent coverage, policy drift, false-positive rates) and report on them to leadership.
Own the roadmap, as Service Owner, for tooling upgrades, migrations, and consolidation, coordinating with vendors and internal stakeholders.
Continue to mature and maintain playbooks, security architecture documentation, and standard operating procedures for the tooling under your ownership as Service Owner.
Evaluate emerging tooling capabilities and threats, and recommend changes to strategy and standards accordingly.
Administer and maintain ZTNA, DLP, EDR, and PAM policies, ensuring new policies are developed, tested, and rolled out without impact to end users or the business.
Managed Detection & Response (MDR) Vendor Oversight
Own the relationship with and performance management of Varicent's MDR vendor.
Oversee vendor performance on Tier 1 and Tier 2 alert triage and deep investigation, holding the vendor accountable for quality, timeliness, and depth of analysis.
Review vendor SLAs, escalation quality, and detection coverage on an ongoing basis; drive corrective action plans where performance gaps are identified.
Coordinate Tier 3 remediation activities across Varicent, partnering with IT, Engineering, and Cloud Operations to ensure timely closure.
Serve as the primary internal escalation point for significant or ambiguous alerts requiring cross-functional coordination.
Incident Response Leadership
Own Incident Response processes, procedures, and playbooks end to end, ensuring they reflect current threats, tooling, and organizational structure.
Draft, lead, and execute required tabletop exercises annually, including scenario design, facilitation, and after-action reporting.
Drive continuous improvement of Incident Response readiness based on tabletop outcomes, real incidents, and industry lessons learned.
Act as a senior escalation point or incident lead during significant security events, coordinating cross-functional response.
Vendor & Cross-Functional Leadership
Coordinate day-to-day security activities with IT analysts, external vendors, managed service providers, and contractors supporting endpoint security operations and incident response.
Provide technical guidance and oversight to external service providers, ensuring alignment with security requirements, operational priorities, and service expectations.
Influence peers and cross-functional partners across IT, Engineering, Cloud Operations, Legal, and Communications to align on security priorities and incident response commitments.
Share technical expertise and best practices with security engineers and cross-functional stakeholders without direct people-management responsibilities.
Communicate tooling health, vendor performance, and incident readiness to leadership through clear, risk-based reporting.
Continuous Improvement & Risk-Based Decision Making
Frame ambiguous, cross-functional problems related to endpoint security and incident readiness, and propose approaches rather than waiting for direction.
Continuously identify opportunities to mature processes, strengthen controls, and improve security outcomes across teams by coordinating engagements with offensive security engineers.
Stay current on the evolving threat landscape and detection/response best practices; share relevant learnings with the broader team.
Required Experience
Bachelor's degree in Computer Science, Information Security, Information Technology, or equivalent experience.
Minimum of 8 years of related experience in Security Engineering, Security Operations, or Incident Response; or 6 years with a Master's degree; or an equivalent combination of education and experience.
At least one relevant information security certification (e.g., CISSP, CCSP, CISA, GCIH, GCIA, or equivalent).
Hands-on experience administering and improving endpoint security tools such as EDR, DLP, ZTNA, PAM, and EPM platforms, following the ITIL framework as a Service Owner delivering continuous service improvements.
Experience installing security agents and supporting IT teams with deployments through Intune, JAMF, and MDM.
Demonstrated experience managing or overseeing third-party security vendors (e.g., MDR, MSSP) and holding them accountable to defined SLAs.
Experience owning or significantly contributing to an organization's Incident Response program, including playbooks, procedures, and tabletop exercises.
Strong understanding of security standards and frameworks (e.g., NIST CSF, NIST 800-61, ISO 27001/27002).
Excellent written and verbal communication skills, with the ability to translate technical risk into business terms for leadership.
Proven ability to operate with significant autonomy on complex, ambiguous problems and coordinate work across internal teams and external service providers.
English proficiency is required.
Preferred Experience
Experience providing technical leadership or coordinating security operations across internal teams, external vendors, or managed service providers without direct people-management responsibilities.
Experience with security automation and orchestration (SOAR) to streamline alert triage and remediation workflows. Experience using AI for automation is a plus.
Familiarity with regulatory and compliance frameworks relevant to Varicent's business (e.g., SOC 2, PCI, HIPAA).
Experience building or maturing an endpoint security program with a service management mindset.
Background in cloud security across major platforms (e.g., AWS, Azure Entra, and MDM).
Develop a full understanding of the current security tooling stack, MDR vendor relationship, and existing Incident Response playbooks.
Establish baseline health metrics and SLAs for each tool and the MDR vendor.
Identify immediate gaps in tooling coverage, policy configuration, or vendor performance.
Drive at least one significant tooling improvement or policy hardening initiative to completion.
Implement a formal vendor performance review cadence with the MDR provider, with clear corrective actions where needed.
Design and lead Varicent's annual tabletop exercise, including scenario development and after-action reporting.
Refine Incident Response playbooks and procedures based on findings from the tabletop exercise and any real incidents.
Demonstrate measurable improvement in tooling health metrics, vendor SLA performance, and incident response readiness.
Establish a security tooling roadmap that anticipates emerging threats and business needs.
Become the primary technical point of contact for endpoint security tooling strategy, vendor performance, and incident response across Varicent.
For this role, the estimated annual base salary range is between CAD $151,200 and CAD $187,200. In addition to base salary, our compensation package may include bonuses, commissions for eligible sales roles, and a comprehensive benefits package. The actual base salary will vary based on factors including individual qualifications and market data, as objectively assessed during the interview process.
This posting is for a new vacancy.
This hiring process utilizes artificial intelligence tools to assist in candidate screening and assessment. Our AI tools are designed to complement — not replace — human decision-making.