Security Engineer (DevSecOps)

About Contour

has grown from a dozen people to over 2,000 staff across 3 cities, in less than 14 years.

As a subsidiary of Constellation Software Inc., we are proud to be part of a global enterprise software conglomerate that has grown to become one of the top 10 software companies in the world, with employees and customers in 100+ countries. With a broad-based and ever-growing portfolio of market-leading, vertical-market enterprise solutions covering more than 100 industry domains in predominantly mature markets, CSI's recipe creates the perfect environment for professionals to build fulfilling, long-term careers.

What started as an R&D & Accounting back-office, has progressed into a full-service Global Centre serving all functions and departments, at the divisional as well as operating group/corporate level. Today Contour employees, located in Karachi, Lahore & Islamabad, are serving CSI divisions located in time zones spanning the globe, from Sydney to Vancouver. With the global growth of Constellation as the wind in our sails, we are only just getting started!

About the Role:

Processing is a modern Payment Facilitator (PayFac) empowering SaaS businesses to grow revenue through seamless, embedded payments. As part of Constellation Software Inc. (TSE:CSU) — a global Canadian-based software leader at a $96B market cap and the 7th largest software company in the world — we combine the agility of a specialized payments company with the strength and stability of an established global powerhouse.

We’re building a cloud-native PayFac platform on AWS: microservices (DDD) across TypeScript/JavaScript, Java, and Ruby, with a ReactJS front end. As our Security Engineer, you’ll co-own the DevSecOps program—driving continuous security automation, compliance automation, and penetration testing. You’ll design and orchestrate SAST/SCA/DAST across our services, champion remediation practices, and partner closely with our compliance team to translate control objectives into repeatable, automated evidence.

Our customers are ISV vendors who embed payments by integrating with our APIs, SDKs, and webhooks. That means security and compliance aren’t afterthoughts—they’re product features. You’ll ensure our developer-facing surface area is secure by default: establishing standards for authentication and authorization (OIDC/OAuth2/JWT, mTLS/JWS for webhooks), key and secret management, request signing, idempotency, rate-limiting/abuse controls, and secure data handling that minimizes PCI scope for ISVs (tokenization, hosted fields/iframes, PAN vault boundaries, network tokens). You’ll create secure integration patterns (reference apps, checklists, threat models/DFDs) so partners can implement quickly without compromising controls.

Because we operate a multi-tenant PayFac, you’ll harden isolation boundaries (network, identity, and data), lead supply-chain security (SBOMs, signing/provenance, gated deployments), and build continuous evidence for PCI DSS 4.0 (and SOC 2/ISO as needed). You’ll collaborate with partner security and compliance teams on due-diligence requests (SIG Lite, AOC/ROCs, shared-responsibility matrices), and you’ll own pre-launch security reviews for new ISV integrations. You’ll also help run incident response drills and define partner-facing comms and SLAs for security events.

Finally, you’ll research and implement AI-assisted security (triage, anomaly detection, auto-remediation PRs) with appropriate guardrails, and own KPIs that demonstrate multiplier effects—e.g., reduced MTTR, lower false-positive rates, higher auto-triage coverage, and faster time-to-evidence—so our platform’s security posture continuously improves as our ISV ecosystem scales.

What You’ll Do:

Own Security Automation:

Embed Security in the SDLC:

Platform & Cloud Security (AWS/EKS):

Compliance Automation:

Penetration Testing & Response:

Research & implement AI security tools:

Own outcomes & KPIs:

Guardrails & governance:

Automation & SOAR integration:

KPIs You’ll Own:

What You’ll Bring:

How We’ll Measure Success:

Team & Reporting:

This role sits in the CTO organization (Engineering/Platform) and partners daily with compliance, DevOps/SRE, Backend/Frontend teams, and Product.

Our Stack (you don’t need all of these):

AWS (EKS, ECR, KMS, CloudHSM, WAF/Shield, CloudFront, GuardDuty, Security Hub,

CloudWatch), GitHub/GitHub Actions, Terraform, Node/TypeScript, Java, Ruby, React,

Kafka, MongoDB, Postgres, Redis, Veracode, OWASP ZAP/Burp, AI Tools in Microsoft Teams, JIRA, Development IDEs (Amazon Q, Cursor, Claude Code)

Exciting Benefits we offer: