Staff Security Engineer

This is a fully remote position, open to applicants in Canada.

📋 Description

• Identify and resolve security vulnerabilities in Trolley's products and infrastructure.

• Perform threat modeling and conduct security-focused code reviews alongside product engineering teams.

• Establish practical security standards and implement them as defaults and tooling.

• Contribute to the design of IAM architecture, incorporating SSO and MFA solutions.

• Develop and sustain shared security tools and CI/CD checks to manage exposed secrets and vulnerable dependencies.

• Streamline vulnerability management through automation.

• Define cloud security guardrails in collaboration with Infrastructure, SRE, and DevOps teams in AWS.

• Minimize the exposure time to newly revealed vulnerabilities and enhance the speed of attack detection.

• Fortify product and user account security against threats such as account takeover and bots.

• Implement measures to combat AI-generated phishing and impersonation through phishing-resistant sign-ins and verified approval processes.

• Leverage AI technology to expedite detection, triage, and response within the boundaries of the AI usage policy.

• Take ownership of the engineering aspects of compliance initiatives, commencing with SOC 2.

• Ensure adherence to relevant global regulations and respond to customer security questionnaires and audit requests.

• Lead technical responses to security incidents, providing accurate facts and timelines for regulatory reporting.

• Enhance logging and detection capabilities.

• Conduct tabletop and purple-team exercises, and define the scope of penetration tests.

• Cultivate a network of security champions and assist engineers in addressing security challenges through reviews, collaboration, and training.

• Collaborate with the manager and engineering leads to prioritize security engineering tasks and oversee their completion.

• Confirm that remediation efforts effectively mitigate the underlying risks.

⛳️ Requirements

• Over 8 years of experience in security or software engineering, including a minimum of 5 years in hands-on security roles.

• Experience in establishing and managing security controls in production environments, including logging and detection mechanisms.

• Proficient in writing code for automating security processes, particularly in TypeScript.

• Expertise in at least one area of application security, cloud security, or detection and response, with a working understanding of the other areas.

• Capable of reading and debugging production application code, implementing and testing security fixes, and safely deploying changes.

• Proven experience in conducting threat modeling and design reviews with product engineering teams.

• Demonstrated experience leading the technical response to security incidents.

• Skilled in transforming compliance requirements into automated controls or evidence.

• Ability to articulate how attackers utilize AI in phishing schemes and account takeovers, identifying effective controls and critically assessing AI tools.

• Experience in encouraging engineering teams to embrace security modifications without direct oversight.

• Comfortable working independently and making decisions through written proposals.

• Able to collaborate effectively with colleagues in Canada and the UK during overlapping working hours.

🏝️ Benefits

• Competitive salary.

• ESOP Program: Meaningful equity and ownership that aligns your success with ours.

• Extended healthcare benefits starting from Day 1.

• 4 weeks of paid vacation annually, in addition to public holidays (+ 1 extra vacation day for each year of service).

• 30 days of remote work from any location.

• Gym membership allowance.

• 1/2 day Fridays off during the summer.

• Company-provided Apple MacBook and Mac accessories.