Senior Security Software Engineer – Developer

This is a fully remote position, open to applicants in Canada, +1 more country.

📋 Description

• Recognize and mitigate security risks across the entire product lifecycle

• Spearhead threat modeling initiatives for products, features, and architectural modifications

• Identify assets, trust boundaries, attack surfaces, abuse scenarios, attack paths, and security controls

• Evaluate product architectures and designs that are sensitive to security

• Convert security risks into engineering specifications, implementation guidelines, verification strategies, and actionable development tasks

• Deliver pragmatic security leadership to software development teams

• Mentor developers and architects on secure design, secure coding practices, threat modeling, and security testing

• Enhance secure product development through risk-based activities, release criteria, reusable guidance, templates, security reviews, and automated CI/CD checks

• Assist teams in implementing defense-in-depth strategies, least privilege principles, secure-by-default behaviors, and suitable isolation boundaries

• Facilitate SBOM generation, validation, completeness checks, release integration, and disclosure in compliance with CycloneDX and related standards

• Conduct CVE monitoring and triage

• Provide support for vulnerability assessments, remediation efforts, disclosure activities, customer communications, and PSIRT practices

• Drive the Product Security contributions to the organization’s ISO/IEC 27001 Information Security Management System (ISMS)

• Lead customer interactions involving security reviews, questionnaires, contractual obligations, and audits

• Collaborate with Software Architects, Developers, Product Management, Compliance teams, and service provider clients

• Design, develop, test, release, and maintain products with robust security measures

⛳️ Requirements

• Over 5 years of professional experience in software engineering, security engineering, or a combination of both

• Extensive hands-on experience in securing production software

• Proficiency with Linux, source control, code review, build systems, CI/CD, automated testing, and contemporary software development practices

• Ability to comprehend production software at the source code level and collaborate with developers on security-sensitive modifications

• Proficient in at least one relevant programming language such as C, C++, Python, Go, Java, JavaScript/TypeScript, or Rust

• Experience implementing Product Security or Application Security practices within a software development environment

• Strong grasp of secure software design principles, common vulnerability classes, attack strategies, and defensive mechanisms

• Practical experience in threat modeling utilizing STRIDE, attack trees, abuse cases, or similar risk-based methodologies

• Familiarity with reviewing software or system architectures from a security standpoint and transforming risks into engineering requirements

• Skill in investigating vulnerabilities and assessing technical impact, exploitability, affected components, and mitigation strategies

• Experience with SBOM and software composition analysis tools, and knowledge of CycloneDX

• Understanding of software dependencies, vulnerability databases, software supply chain risks, and vulnerability remediation

• Knowledge of software development, packaging, release, deployment, and maintenance in production environments

• Ability to articulate complex technical security risks to developers, architects, product leaders, auditors, and clients

• Sound engineering judgment that balances risk reduction with product constraints, delivery needs, reliability, performance, and maintainability

• Ability to lead through technical credibility, collaboration, coaching, and influence

• Comfortable working with multiple engineering teams

• Capable of developing and delivering customer presentations and leading collaborative technical engagements

• Preferable experience with embedded Linux or Linux-based product development

• Preferable experience with networking products, telecommunications, distributed systems, or cloud-connected devices

• Preferable experience with secure boot, trusted execution, hardware-backed identity, cryptographic key management, signed software updates, or device lifecycle security

• Preferable experience with vulnerability reproduction, SAST, DAST, fuzzing, penetration testing, binary analysis, reverse engineering, or runtime security analysis

• Preferable familiarity with CycloneDX VEX, CSAF, SPDX, purl, CPE, CVE, CVSS, CWE, CISA KEV, vulnerability disclosure, PSIRT, ISO/IEC 27001, NIST SSDF, OWASP SAMM, or IEC 62443

• Relevant security or software certifications are considered a plus

🏝️ Benefits

• Privacy protection throughout the recruitment process

• Phone/video interviews

• Technical/skills assessments if applicable

• In-person or final interviews

• Professional references and verification of employment or education

• Onboarding preparation, orientation, and support on the first day