Senior / Staff Security Engineer

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Senior / Staff Security Engineer based in Canada. The Senior / Staff Security Engineer will play a key role in strengthening product and infrastructure security for a rapidly evolving software platform serving teams worldwide. In this hands-on position, you will help shape and scale security practices as the product expands its capabilities and enterprise presence. You will own critical security initiatives spanning vulnerability management, application security, incident response, and cloud infrastructure protection. Working closely with engineering and trust teams, you will integrate security into product development, improve detection and remediation processes, and build automation that scales with the business. This remote-first opportunity offers significant autonomy, technical ownership, and the chance to influence security strategy while working with modern cloud technologies and AI-assisted engineering tools. Accountabilities - Own and continuously improve the vulnerability management lifecycle, including identifying, triaging, prioritizing, and remediating vulnerabilities across the product, infrastructure, and software dependencies. - Maintain effective vulnerability remediation service-level agreements (SLAs), ensuring security findings translate into meaningful risk reduction. - Manage the bug bounty program by reviewing incoming reports, validating severity, coordinating fixes with engineering teams, and maintaining professional relationships with security researchers. - Lead product security assessments, including threat modeling new features, reviewing architecture and code, and conducting hands-on manual and tool-assisted testing. - Evaluate emerging security risks associated with AI-powered features and agent-facing product capabilities.

- Serve as a primary incident responder, leading investigations, coordinating containment and recovery, facilitating post-incident reviews, and translating lessons learned into concrete security improvements. - Strengthen cloud and infrastructure security across Google Cloud Platform (GCP), Kubernetes, PostgreSQL, and related services by hardening configurations and implementing secure defaults. - Address security gaps identified through audits, automated scanning, and internal assessments in collaboration with infrastructure and engineering teams. - Build and maintain security tooling, detections, scripts, and automation to improve operational efficiency and scale security processes. - Leverage AI and large language model (LLM) tools to accelerate vulnerability triage, code review, and repetitive investigative tasks while maintaining appropriate technical oversight. - Partner with Governance, Risk, and Compliance (GRC) and Trust teams to document risks, maintain risk registers, collect control evidence, and align compliance requirements with actual engineering practices. - Communicate technical findings, risks, and remediation recommendations clearly to technical and non-technical stakeholders. - Establish priorities independently, make pragmatic risk-based decisions, and escalate critical issues when necessary. Requirements: - At least five years of experience in security engineering, with substantial hands-on expertise in at least two of the following areas: vulnerability management, product or application security testing, incident response, and cloud security. - Broad security engineering knowledge and the ability to work across multiple domains rather than focusing exclusively on a single specialization. - Strong technical skills, including the ability to read, understand, and reason about application code, particularly TypeScript or comparable programming languages. - Practical experience working in cloud environments; familiarity with Google Cloud Platform (GCP) is an advantage.