Platform Security & Governance Engineer
About the role
Clinical research data is among the most sensitive data there is — participant information, safety records, regulatory documents, and the evidence trials are ultimately inspected on. MAESTRO's job is not only to
protect
that data, but to
prove
it is protected, on demand, to auditors and regulators. This role owns both halves of that promise.You'll own how MAESTRO enforces access, records every consequential action, and demonstrates compliance — from role-, study- and site-scoped access control, to immutable audit trails, to the governance program behind our certifications and our customers' inspections. Security and governance here aren't a gate at the end;
they're a core part of the product we sell.This is a hands‑on role for someone who can move fluidly between engineering controls and the compliance program they satisfy.What you'll do
Design and enforce
role-, study- and site-scoped access control
and separation of duties across a multi‑tenant platform.Own the
immutable audit trail
— a defensible record of who changed what, and when — across every module.Drive
data governance
: classification, retention, residency, encryption and key management, so sensitive data stays in‑region and within policy.Lead
PIPEDA
alignment and
SOC 2 / ISO 27001
readiness — owning policies, evidence collection, and vendor/third‑party reviews.Run
threat modelling and security reviews
, and coordinate penetration testing and remediation.Translate regulatory expectations ( 21 CFR Part 11, EU Annex 11, ICH GCP, Health Canada
) into concrete, testable engineering controls — and into the evidence that proves they work.What you'll bring
4+ years in
application/platform security
or security engineering.Solid understanding of
authentication and authorization,



encryption, secrets management and audit logging
.Familiarity with privacy and security frameworks —
PIPEDA, GDPR, SOC 2, ISO 27001, NIST
.The ability to turn compliance requirements into shipped engineering controls, not just documentation.Nice to have
Experience in
healthcare, life‑sciences
or other regulated domains.Knowledge of
21 CFR Part 11
audit‑trail and electronic‑signature requirements.Hands‑on experience with cloud security tooling and
infrastructure‑as‑code security scanning
.Education
Minimum:
a Canadian
Bachelor's degree (baccalauréat)
in
Computer Science, Cybersecurity, Information Security/Systems
or a related technical field —
or
a
college diploma / advanced diploma (DEC, 2–3 years)
in a relevant program combined with significant security‑engineering experience.An asset (not required):
a
Master's degree (maîtrise)
in cybersecurity, information security or a related technical field;
or recognized security or privacy certifications (e.G. CISSP, CISM, CCSP, or equivalent).Internationally educated candidates are welcome;
foreign credentials should be
assessed for Canadian equivalency
(e.G. WES, ICAS or a comparable recognized service) to confirm the equivalent Canadian level.Location & eligibility
This role is
open only to candidates who are based in Canada and legally entitled to live and work in Canada
(Canadian citizens, or permanent/legal residents with valid Canadian work authorization). We are not able to sponsor relocation or work authorization for this position.Why join
Security and governance aren't an afterthought here — they're the product. You'll build the controls that let a customer hand an inspector a link instead of scrambling for evidence, and you'll see your work directly enable trials to keep moving.
#J-18808-Ljbffr

📌 Platform Security & Governance Engineer (Winnipeg)
🏢 RAN BioLinks
📍 Winnipeg