Senior Software Engineer (Product Security)

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Software Engineer (Product Security) based in Canada. This role combines senior-level software engineering with a strong product security focus in a cloud-native infrastructure environment. You will design, build, and maintain production features while helping embed security directly into the product and engineering lifecycle. Your work will span vulnerability response, threat modeling, security-sensitive design reviews, and technical decision-making across the platform. You will work deeply within the codebase and architecture rather than focusing primarily on security tooling or compliance operations. The role offers significant technical ownership and the opportunity to influence secure engineering practices across a distributed, remote-first team. Accountabilities: - Design, build, and maintain production features alongside the broader engineering team, contributing to roadmap initiatives when dedicated security work is not in progress. - Own vulnerability response from initial triage and prioritization through investigation, remediation, patched releases, and coordinated disclosure when required. - Conduct threat modeling for new features and security-sensitive designs, identifying risks early and helping engineering teams make informed security decisions. - Participate in code reviews, architecture reviews, and technical discussions, bringing a product security perspective to engineering decisions. - Review the security implications of evolving platform architecture and identify opportunities to strengthen the product's security posture. - Help engineers establish secure defaults and incorporate security considerations naturally into the software development lifecycle. - Act as a technical security resource for the product, helping teams understand vulnerabilities, risks, mitigations, and practical security trade-offs. Requirements: - Proven experience building and shipping production software with Go as a primary programming language.

- Strong working knowledge of Kubernetes internals, including the API server, admission control, RBAC, controllers, and kubelet. - Experience building Kubernetes controllers or operators using technologies such as controller-runtime, Kubebuilder, or client-go is highly relevant. - Hands-on understanding of the Kubernetes attack surface, including container breakout, privilege escalation, RBAC risks, and security policy best practices. - Experience with threat modeling and secure design reviews for production systems, with the ability to clearly communicate security risks and recommendations to engineers. - Demonstrated experience investigating and fixing vulnerabilities in software you have worked on, including familiarity with the CVE lifecycle, coordinated disclosure, and security patch releases. - Strong software engineering fundamentals and the ability to work deeply within complex codebases and distributed infrastructure. - Ability to balance security priorities with product development and contribute to broader engineering objectives. - Experience working autonomously and taking ownership in an early-stage or fast-moving environment is a plus. - Certified Kubernetes Security Specialist (CKS) certification is a bonus. Benefits: - Competitive compensation package including equity. - Health, dental, vision, and life insurance, with coverage options for eligible dependents depending on country. - Flexible working schedule focused on outcomes rather than fixed working hours. - Flexible workplace arrangements, allowing employees to adapt their work environment as circumstances change. - Remote-first work environment within a globally distributed team. - Opportunity to work on production infrastructure software and contribute directly to secure cloud-native and Kubernetes technologies.