The mission of triOS Education Group through triOS College Business Technology Healthcare and Eastern College is to help students become job-ready graduates. triOS Education Group operates 9 triOS College Business Technology Healthcare campuses across Ontario and 4 Eastern College campuses in Atlantic Canada focusing on providing practical hands-on training in-person, online and hybrid delivery models based on student choice which enables students to be successful in their chosen careers. The program curriculum is extremely comprehensive and is uniquely developed with input from industry leaders to provide the highest quality education and practical hands-on experience enabling a quick career progression for graduates. Canadian-owned and operated, triOS Education Group is proud to be recognized as one of Canada’s Best Managed Companies for fifteen years. triOS has been awarded the Platinum designation for redefining post-secondary education by listening to students and employer needs to deliver effective results. Since 1992, triOS College and Eastern College have prepared over 80,000 job-ready graduates for rewarding careers.

About The Role We’re seeking an experienced Security Analyst to join Shopify’s security organization, focused on our Bug Bounty program operations. Shopify powers millions of merchants worldwide—which means a large and dynamic attack surface. You'll work at the intersection of external researchers, internal engineering, and AppSec, turning vulnerability reports into clear, actionable findings that protect Shopify and its merchants. This role is equal parts security analysis, operational excellence, and high-quality communication. Your key areas of ownership are: <ul><li>Bug bounty report triage quality and timeliness (meet SLOs, keep queues healthy, reduce rework).</li><li>Reproducing and validating reported security issues (prove exploitability, confirm impact, confirm affected assets, confirm fixes via retest/validation).</li><li>Writing clear, friendly, high-signal communication to external researchers while representing Shopify well.</li><li>Maintaining meticulous internal documentation and context so issues can be routed and resolved efficiently.</li><li>Using data to quantify performance and program health (queue state, SLOs, throughput, trend reporting).</li><li>Partnering with AppSec engineering when a report requires deeper engineering expertise.</li><li> </li><li> </li></ul>You will: <ul><li>Detect, evaluate, and help address security threats to Shopify and its merchants; develop security controls and protocols; perform security audits; conduct vulnerability assessments and penetration tests; assist in the creation and implementation of security solutions; help mitigate compliance and regulatory risks.</li><li>Solve problems quickly and follow (and improve) the team’s playbooks.</li><li>Be meticulous in documentation and context capture (so others can pick up work without losing time).</li><li>Use data to investigate emerging risks/trends and translate them into repeatable solutions.</li><li>Mentor teammates, raise the bar, and become the “go-to” expert in at least one area of the program (triage domain, vulnerability class, product area, tooling/workflows, etc.).</li><li> </li><li> </li></ul>To be successful in this role you will need: <ul><li>Strong written communication skills.</li><li>A track record of fast, high-quality problem solving, with good judgment around impact, severity, and next steps.</li><li>Comfort operating in externally-facing workflows with security researchers, representing Shopify professionally and consistently.</li><li>Operational discipline: you follow playbooks, improve them when they’re wrong or incomplete, and turn “institutional knowledge” into documentation.</li><li>High attention to detail in notes, reproduction steps, evidence, and decision rationale.</li><li>A data-informed mindset: you use metrics to quantify your throughput and quality, track trends, and help improve program health over time.</li><li>A growth-and-multiplication approach: you mentor teammates, raise the bar, and develop deep expertise in at least one domain (vuln class, product area, triage workflow/tooling).</li><li>A strong sense of accountability: you take responsibility for the quality of your interactions and outcomes, and you’re ambitious about improving the security and experience we deliver.</li><li> </li><li> </li></ul>Role-specific Experience / Capabilities <ul><li>Strong working knowledge of web application security fundamentals (authn/authz, session management, injection, IDOR, SSRF, XSS, CSRF, access control, multi-tenant risk, etc.).</li><li>Demonstrated ability to reproduce vulnerability reports reliably and communicate impact precisely.</li><li>Experience doing vulnerability assessment and/or penetration testing (professionally or in a structured program).</li><li>Strong judgment on severity/impact assessment and how to ask for additional info when needed.</li><li>Comfortable working in operational queues and juggling multiple in-flight investigations without losing quality.</li><li> </li><li> </li></ul>About Shopify Opportunity is not evenly distributed. Shopify puts independence within reach for anyone with a dream to start a business. We propel entrepreneurs and enterprises to scale the heights of their potential. Since 2006, we’ve grown to over 8,300 employees and generated over $1 trillion in sales for millions of merchants in 175 countries. This is life-defining work that directly impacts people’s lives as much as it transforms your own. This is putting the power of the few in the hands of the many, is a future with more voices rather than fewer, and is creating more choices instead of an elite option. About You Moving at our pace brings a lot of change, complexity, and ambiguity—and a little bit of chaos. Shopifolk thrive on that and are comfortable being uncomfortable. That means Shopify is not the right place for everyone. Before you apply, consider if you can: <ul><li>Care deeply about what you do and about making commerce better for everyone</li><li>Excel by seeking professional and personal hypergrowth</li><li>Keep up with an unrelenting pace (the week, not the quarter)</li><li>Be resilient and resourceful in face of ambiguity and thrive on (rather than endure) change</li><li>Bring critical thought and opinion</li><li>Put AI agents and tools to work on the tasks they're built for, and focus on the work only humans can do</li><li>Embrace differences and disagreement to get shit done and move forward</li><li>Work digital-first for your daily work</li><li> </li><li> </li></ul>We may use AI-enabled tools to screen, select, and assess applications. All AI outputs are reviewed and validated by our recruitment team.

Security Analyst (Bug Bounty Analyst) (Canada , Americas) is no longer accepting applications.