Security Architect, Vulnerability Management & Risk
Vancouver, BC (Hybrid) | Full-time | Enterprise FinTech
About the opportunity
Our client is a Vancouver-headquartered enterprise software company at the intersection of banking and business software. They're one of Vancouver's fastest growing SaaS companies serving some of the largest banks in North America and Europe.
This is a newly created seat, and the company has reached the point where vulnerability management, technical risk reviews, and vendor security assessments need a dedicated owner. You will own that technical oversight end to end and support the security strategy and roadmap.
Who this is for
You've got enough real technical depth to hold your own with engineers: you understand how cloud environments get compromised, you've worked with vulnerability management and penetration testing, and you've reviewed real security architectures. You don't need to be the person running the scans or writing the exploits. You need to be the person who owns the program, decides what matters, and brings it to engineering, product, and GRC in language they can act on. If you've spent time in a security consulting or advisory practice on top of a technical foundation, this could be a good fit.
What you will do
Own technical oversight
- Lead security and risk reviews for material technology, infrastructure, integration, product, and operational changes.
- Run threat modeling, product risk assessments, and third-party vendor security assessments.
- Provide security-by-design guidance for new systems, internet-facing services, AI capabilities, shared platforms, and sensitive data integrations.
- Define security principles, control expectations, and risk guardrails across cloud, SaaS, data flows, identity, privileged access, and production environments.
Own the vulnerability management and testing program
- Own the vulnerability management strategy and governance process across applications, infrastructure, cloud services, and shared platforms.
- Set risk-based severity, prioritization, remediation expectations, escalation paths, and exception handling.
- Govern the penetration testing program and turn findings into clear remediation priorities.
- Spot recurring vulnerability patterns and drive durable control improvements with measurable risk reduction.
- Provide oversight of high-severity findings, external exposure, and emerging threats.
Advise across the business
- Be the technical security voice for Engineering, Infrastructure, Product, GRC, and Legal, so teams get clear answers early.
- Translate technical risk into business impact and recommendations leadership can act on.
Support strategy and governance
- Help build and maintain the security strategy, priorities, and roadmap in line with business objectives, regulatory obligations, and bank partner expectations.
- Contribute to security governance, risk reporting, and oversight of material exceptions and risk acceptances.
What you bring
Experience
- 5+ years in security architecture, cloud security, application security, security assurance, security consulting, or technical risk. Depth matters more to this team than years.
- Working experience with vulnerability management and penetration testing, whether you've owned a program, contributed to one, or assessed them as a consultant.
- Experience reviewing architecture and implementation decisions in SaaS or cloud-native environments.
Technical depth
- Conversational command of AWS security: you can explain how a cloud environment gets compromised and what stops it.
- OWASP Top 10 and API security are second nature.
- Familiarity with Snyk and Tenable, or comparable SAST and vulnerability scanning tools.
- Strong understanding of controls across IAM, cloud infrastructure, network security, logging and monitoring, and production access.
Risk and strategy fluency
- Comfortable with frameworks like NIST CSF and NIST 800-53, and with producing risk assessments and documented security decisions that GRC and auditors can rely on.
- You can assess material risk, identify control gaps, and drive remediation that actually ships.
How you work
- Strong writer. Your recommendations, design feedback, and executive summaries are clear enough that engineers and executives both act on them.
- The pragmatic voice in the room: you help teams move quickly without introducing avoidable risk.
- Collaborative by default across Engineering, Infrastructure, Product, Legal/GRC, and Security.
Nice to have
- Background in FinTech, embedded finance, or regulated SaaS.
- Familiarity with Kubernetes/EKS, cloud networking, and production change patterns.
- Experience reviewing shared infrastructure, workflow automation platforms, and operational tooling.
- CISSP, CCSP, AWS Security Specialty, or similar are welcome, but conversational depth matters more than the letters.
Logistics
- Hybrid: Tuesday, Wednesday, and Thursday in the downtown Vancouver office.
- Candidates must be authorized to work in Canada
Compensation
Highly competitive base salary, flexible for the right profile, plus semi-annual bonus, equity, extended benefits, and savings/retirement matching.
