Senior Security Engineer

This is a fully remote position, open to applicants in Canada.

📋 Description

• Safeguard gaiia’s products, infrastructure, customers, and teams through effective technical execution and pragmatic security leadership.

• Conduct threat modeling and perform architecture reviews.

• Evaluate authentication, authorization, tenant isolation, sensitive workflows, and secure development standards.

• Execute internal penetration tests and collaborate with developers for issue remediation.

• Establish and maintain a bug bounty program.

• Assess configurations for AWS, Snowflake, GitHub, and other critical vendors.

• Enhance IAM, enforce least privilege principles, and manage production access for staff and cloud resources.

• Review logging, detection mechanisms, cloud security monitoring, infrastructure as code, and deployment pipelines.

• Fortify data stores, networks, backups, and encryption controls.

• Manage the intake of vulnerabilities, prioritization, remediation SLAs, root-cause analysis, and corrective actions.

• Assess security alerts, coordinate investigations, maintain incident response plans, and conduct training exercises.

• Uphold policies, controls, evidence, and customer-facing security posture for SOC 2, GDPR, and PCI compliance.

• Coordinate with auditors and facilitate external assessments.

• Assist Sales with security questionnaires and support the CTO in security-related sales and legal negotiations.

• Review the security controls of vendors and subprocessors.

• Develop employee and engineering security training programs and establish security champions.

• Maintain a prioritized security roadmap and report significant risks and progress to leadership.

• Engage in the long-term strategy to build the security team.

• Report to the Platform Lead while working closely with the Platform Lead and CTO.

⛳️ Requirements

• Minimum of five (5) years of experience in Software Engineering, Application Security, Infrastructure Security, or a closely related technical field.

• Extensive experience in securing modern web applications, APIs, distributed systems, and cloud infrastructure.

• Proficient experience with AWS.

• Strong familiarity with the JavaScript / TypeScript ecosystem.

• Experience with React.

• Proven experience working with microservices, serverless architectures, infrastructure as code, CI/CD pipelines, and production systems.

• Comprehensive understanding of authentication, authorization, secrets management, IAM, logging, monitoring, and secure SDLC practices.

• Experience in penetration testing, bug bounty programs, SAST, dependency scanning, etc.

• Exceptional judgement and pragmatism when making and executing critical business decisions.

• A rigorous, calm, and level-headed approach to handling incidents, uncertainty, and high-pressure situations.

• Excellent communication skills, with an ability to coach, influence, and empower teams without causing unnecessary delays.

• Capacity to prioritize security efforts based on business impact, customer risk, operational urgency, and engineering feasibility.

• Experience in reviewing product architecture, identifying practical security risks, and collaborating with engineering teams to implement effective mitigations.

🏝️ Benefits

• Competitive salary.

• Stock Options Plan.

• Group Insurance coverage.

• Access to Telemedicine services.

• Life and Health Spending Accounts.

• Group Retirement Savings Plan (RRSP).

• Flexible vacation policy with 25 days off.

• Flexible working hours.

• 100% remote / all-remote work option.

• Accessible technologies and disability accommodations during the application process.