Senior / Staff Security Engineer

Job description

**This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Senior / Staff Security Engineer based in Canada.** The Senior / Staff Security Engineer will play a key role in strengthening product and infrastructure security for a rapidly evolving software platform serving teams worldwide. In this hands-on position, you will help shape and scale security practices as the product expands its capabilities and enterprise presence. You will own critical security initiatives spanning vulnerability management, application security, incident response, and cloud infrastructure protection. Working closely with engineering and trust teams, you will integrate security into product development, improve detection and remediation processes, and build automation that scales with the business. This remote-first opportunity offers significant autonomy, technical ownership, and the chance to influence security strategy while working with modern cloud technologies and AI-assisted engineering tools. ### Accountabilities - Own and continuously improve the vulnerability management lifecycle, including identifying, triaging, prioritizing, and remediating vulnerabilities across the product, infrastructure, and software dependencies. - Maintain effective vulnerability remediation service-level agreements (SLAs), ensuring security findings translate into meaningful risk reduction. - Manage the bug bounty program by reviewing incoming reports, validating severity, coordinating fixes with engineering teams, and maintaining professional relationships with security researchers. - Lead product security assessments, including threat modeling new features, reviewing architecture and code, and conducting hands-on manual and tool-assisted testing. - Evaluate emerging security risks associated with AI-powered features and agent-facing product capabilities. - Serve as a primary incident responder, leading investigations, coordinating containment and recovery, facilitating post-incident reviews, and translating lessons learned into concrete security improvements. - Strengthen cloud and infrastructure security across Google Cloud Platform (GCP), Kubernetes, PostgreSQL, and related services by hardening configurations and implementing secure defaults. - Address security gaps identified through audits, automated scanning, and internal assessments in collaboration with infrastructure and engineering teams. - Build and maintain security tooling, detections, scripts, and automation to improve operational efficiency and scale security processes. - Leverage AI and large language model (LLM) tools to accelerate vulnerability triage, code review, and repetitive investigative tasks while maintaining appropriate technical oversight. - Partner with Governance, Risk, and Compliance (GRC) and Trust teams to document risks, maintain risk registers, collect control evidence, and align compliance requirements with actual engineering practices. - Communicate technical findings, risks, and remediation recommendations clearly to technical and non-technical stakeholders. - Establish priorities independently, make pragmatic risk-based decisions, and escalate critical issues when necessary. ### Requirements: - At least five years of experience in security engineering, with substantial hands-on expertise in at least two of the following areas: vulnerability management, product or application security testing, incident response, and cloud security. - Broad security engineering knowledge and the ability to work across multiple domains rather than focusing exclusively on a single specialization. - Strong technical skills, including the ability to read, understand, and reason about application code, particularly TypeScript or comparable programming languages. - Practical experience working in cloud environments; familiarity with Google Cloud Platform (GCP) is an advantage. - Demonstrated ability to investigate security findings in depth, identify root causes, and work directly toward effective remediation rather than simply reporting issues. - Experience with vulnerability assessment, threat modeling, security testing, incident investigation, or infrastructure hardening. - Familiarity with AI-assisted coding and security tools, such as Claude, Codex, or comparable solutions, and the ability to use them responsibly to improve productivity. - Strong incident management skills, including the ability to remain composed under pressure, lead investigations independently, and coordinate post-incident reviews. - A builder mindset, with a preference for developing scripts, tools, detections, and automation to eliminate repetitive manual work. - A pragmatic, risk-focused approach that prioritizes measurable security improvements over compliance checklists or raw finding counts. - Strong ownership and prioritization skills, with the ability to work independently, navigate ambiguity, and recognize when escalation is necessary. - Excellent written and verbal communication skills, including the ability to explain complex technical risks clearly and provide actionable recommendations. - Ability to collaborate effectively with product, infrastructure, engineering, and compliance stakeholders in a distributed, remote-first environment. - Familiarity with security and collaboration tools such as GitHub Advanced Security, RunReveal, SentinelOne, Vanta, GitHub, and Slack is beneficial. ### Benefits: - Competitive compensation: Salary and equity opportunities; a specific salary range for Canada was not provided. - Equity benefits: Employee-friendly equity terms, including early exercise options in the United States and extended exercise windows. - Remote-first work: Work remotely without a required daily commute. - Flexible workspace: Paid coworking space or desk. - Health coverage: Coverage provided according to applicable country requirements. - Paid time off: Five weeks of paid vacation annually, in addition to local statutory holidays. - Parental leave: Four months of paid parental leave. - Extended time off: A paid month off after four years of service and every two years thereafter. - Daily meal and coffee stipend for every workday. - Team connection: Regular team events and off-sites. - Work environment: A focused, collaborative team culture that values technical excellence, autonomy, and thoughtful execution.