Security Operations Specialist

About Optable

Optable is a Canadian, VC-backed data collaboration and identity platform built for the advertising ecosystem. We help publishers, media owners, advertisers, and partners securely collaborate on audience insights, campaign planning, activation, and measurement — all with privacy at the core. Founded in 2020 by ad tech industry veterans, Optable is restructuring the advertising industry for the privacy-conscious era and was recently recognized as a Deloitte Technology Fast 50 Enterprise Industry Leaders award winner.

Our latest innovation, Agentic Collaboration, brings autonomous AI-driven agents into adtech workflows — and keeping that infrastructure secure is a challenge we take seriously.

We are a rapidly growing startup that values execution, innovation, and a "no jerks" policy. Our team embraces a culture of ownership, humility, and initiative to solve tough technical and business challenges.

The Role

We're looking for a Security Operations Specialist to join our IT & Security team, reporting to the IT & Security Manager. You'll be hands-on across detection and response, cloud security, endpoint management, and compliance — helping mature our security posture as the company scales.

This isn't a passive monitoring role. You'll build detection logic, investigate real threats, harden production systems, and help shape security strategy. If you like owning problems end-to-end in a fast-moving environment, this is for you.

Key Responsibilities

Cloud-Native Security

• Implement and maintain security controls across our cloud environments, primarily Google Cloud Platform (GCP) with some AWS presence — including IAM policies, network security, service account governance, and Kubernetes hardening.
• Secure and monitor Google Workspace configurations — DLP rules, sharing controls, trust policies, and identity services.
• Review and improve container security across our cloud-native infrastructure.

Detection, Response & Threat Intelligence

• Monitor, triage, and investigate security alerts across endpoints, cloud infrastructure, and SaaS applications.
• Conduct detailed investigations to separate false positives from real intrusion attempts.
• Develop and tune detection rules, automated response playbooks, and remediation workflows.
• Continuously improve incident response protocols, including remediation, reporting, and disclosure procedures.
• Track emerging threats — supply chain attacks, credential compromise, phishing campaigns — and proactively implement countermeasures.

Security Tooling & Endpoint Management

• Own and manage a suite of security tools including SIEM, EDR, and MDM platforms (we use Iru for our macOS fleet and Chronicle for SIEM).
• Manage endpoint security across macOS devices — enforcing security baselines, application controls, OS update policies, and custom detection scripts.
• Evaluate, configure, and iterate on security tooling to ensure company-wide coverage in a lean, startup environment.

Software Supply Chain Security

• Monitor and harden software supply chains across package managers and CI/CD pipelines.
• Develop and maintain automated scanning and blocking mechanisms for known malicious packages and CVEs.
• Collaborate with engineering to integrate security checks into the development lifecycle.

AI & Agentic Workflow Security 

• Support the security posture of Optable's Agentic Collaboration platform — ensuring AI agent workflows, API integrations, and data pipelines meet security and privacy standards.
• Help define security guardrails for LLM-driven and MCP-based agent interactions.

Compliance & Governance

• Support ongoing compliance efforts through DRATA (SOC 2, privacy frameworks).
• Conduct and respond to vendor security assessments.
• Maintain security documentation, policies, and runbooks.
• Assist with access reviews, onboarding/offboarding processes, and audit evidence collection.

Qualifications

Required

• 2–5 years of experience in SecOps, DevSecOps, or a hands-on security role, preferably in cloud environments.
• Practical experience securing Google Cloud Platform (GCP) or comparable cloud infrastructure, including Kubernetes and containerized deployments.
• Experience with Google Workspace security configuration and identity management.
• Proficiency in configuring and managing security tools for Apple/macOS environments (MDM, EDR). Hands-on macOS experience is a strong plus.
• Experience with SIEM and EDR platforms used to detect and respond to malicious activity.
• Demonstrated incident response experience — you've investigated real alerts and driven remediation.
• Comfortable writing scripts to automate detection, scanning, and remediation tasks.
• Familiarity with threat hunting processes and the ability to conduct root cause analysis.
• Self-motivated and comfortable in a VC-backed startup where you wear multiple hats.
• Strong communication skills, written and verbal.

Nice-to-Have

• Experience with configuration management tools like Terraform.
• Familiarity with software supply chain security.
• Experience with DRATA or similar GRC platforms for continuous compliance monitoring.
• Familiarity with AI/LLM security considerations — prompt injection, agent authorization, API security.
• Experience with network security tools (IDS/IPS, DNS analysis, packet capture).
• Understanding of zero-trust networking concepts (e.g., Tailscale).
• Enthusiasm for using AI tools (e.g., LLMs, coding assistants) to accelerate security workflows, automate analysis, and improve operational efficiency.
• French language proficiency.

What We Offer

• A vibrant and inclusive work culture in a rapidly growing startup.
• Opportunities for professional growth and development.
• Competitive salary and equity packages.
• Comprehensive benefits including health, dental, and vision insurance.
• A small, senior team with low bureaucracy and high ownership.
• Collaborative and supportive work environment within a rapidly growing business.
• In-office daily lunches

If you're a security practitioner who thrives in a scrappy, fast-moving environment and you embrace a "no jerks" policy, we'd love to hear from you. Let's see if we can work together.