Staff Security Engineer

Description

This is a remote role open only to candidates based in the US or Canada. Applicants located outside those two countries will not be considered.

The company is an applied AI engineering firm that designs and ships AI systems that connect to clients' enterprise operations. It works heavily on AWS and pairs UX specialists with senior engineers to get AI into production and keep it running.

Founded in 2009, the company has delivery centers in Canada, the US, Eastern Europe, and Latin America. It works with clients in consumer products, retail, education, energy, financial services, healthcare, and manufacturing. Its teams average 15+ years of experience and put production AI in place in 30 to 45 days.

This is a Staff Security Engineer role leading security for the cloud applications and AI systems the company builds for clients. You will work across multiple client engagements as a senior technical leader.

Responsibilities

• Do hands-on security engineering across the areas below, listed in priority order.
• Required: Apply secure coding, OWASP Top 10 knowledge, vulnerability management, and secure code review. Lead threat modeling and security design reviews for web, API, cloud-native, and AI systems, and set how risks are identified and ranked.
• Required: Design cloud controls across identity, network, and data layers, including secrets management and encryption. Bring deep AWS IAM skill covering cross-account trust, permission boundaries, IAM Identity Center or an equivalent federation model, policy evaluation, and Organizations with service control policies. Attaching managed policies alone does not meet the bar.
• Required: Secure Kubernetes at real scale, covering RBAC, admission control, Helm, and federating workload identity into cloud IAM. Single-cluster or local experience does not transfer.
• Required: Write production Python against cloud provider SDKs, not just scripts, to build configuration baselines, provisioning workflows, scheduled jobs, log pipelines, CLI tools, and evidence automation.
• Required: Own Terraform work, including module design, state management, drift, and reviewing other teams' plans.
• Required: Build security automation and policy-as-code into CI/CD pipelines to catch issues earlier across teams.
• Required: Run controls for SOC 2, ISO 27001, PCI, or equivalent frameworks and automate evidence collection where possible. Doing audit evidence work is mandatory.
• Required: Own the security of AI and LLM applications in production, defining defenses against prompt injection, data leakage, model abuse, and agentic AI threats.
• Required: Use SQL on Athena, BigQuery, Presto, Snowflake, or equivalent engines to investigate and gather evidence. Most of your answers will come from queries.
• Preferred: Use AI within security workflows, including LLM APIs, tool and function calling, and multi-step agent flows for detection and triage.
• Preferred: Secure AI training and inference infrastructure, including GPU clusters, at scale.
• Preferred: Automate cloud account provisioning and decommissioning, baselining, and inventory, with desired-state reconciliation, blast-radius reasoning, and safe rollout.
• Preferred: Working knowledge of GCP, including IAM, organization policy, deny policies, audit logging, and GKE.
• Preferred: Detection engineering, logging, and incident response at scale.
• Preferred: Observability basics, including metrics pipelines, SLI and SLO definition, and alert design with Prometheus, Grafana, or OpenTelemetry.
• Preferred: Penetration testing.
• Preferred: Working in multi-vendor environments.
• Partner with product, engineering, and leadership to shape security strategy and tie technical direction to business goals.
• Explain complex security tradeoffs, risks, and opportunities in plain terms that help both technical and non-technical stakeholders decide.
• Run security reviews and technical debates, holding the team to high standards while challenging ideas constructively.
• Work with engineering, data, and client teams so security work supports wider business priorities and measurable results.
• Define security architecture and engineering standards, weighing tradeoffs, long-term effects, and responsible AI practices.
• Coach junior and mid-level engineers through feedback, code reviews, and pairing on difficult problems.
• Take the most ambiguous and highest-stakes work through to production, with attention to reliability, cost, and safety.

Requirements

• Experience with policy-as-code tools such as Open Policy Agent with Rego, Kyverno, or Cloud Custodian.
• Experience with cloud security posture management tools such as Wiz, Prisma Cloud, Orca, or Prowler.
• Experience with SIEM tooling.
• Experience with PKI and certificate lifecycle management.
• Experience with Azure.
• Experience with Cilium, eBPF, Envoy, and the Kubernetes Gateway API.
• Experience with Go or Rust.
• Experience with distributed job scheduling.
• 7+ years of professional security or software engineering experience, including at least 3 years leading application and cloud security initiatives.
• 4+ years in cloud platform engineering, cloud security engineering, or infrastructure production engineering.
• Proven leadership and mentoring across a team or organization.
• Strong communication with both technical and non-technical audiences.
• Daily hands-on use and expert knowledge of AI tools such as Claude and Cursor.
• Strong problem solving and sound judgment when requirements and risks are unclear.
• You are a doer who fixes what is broken and would rather act on clarity than wait for certainty.
• You keep learning quickly. You know you do not know everything and stay curious as AI changes weekly.
• You give direct, honest feedback and will have the hard conversation rather than offer empty praise.
• You care about detail and do not put your name on work you would not stand behind.
• You take ownership: you keep commitments, admit mistakes fast, back teammates on costly decisions, and avoid handoffs and blame.
• You treat clients' businesses as your own and take the work seriously without taking yourself too seriously.
• You stay resourceful when budget, timeline, or team size is tight.
• You want to work alongside people who push each other to do better work.

Conditions

Remote role, open only to candidates based in the US or Canada.

Salary range is $116,000 to $161,000 USD. Actual pay may be above or below this range, and the range may change. Placement within it depends on factors such as education, qualifications, certifications, experience, skills, seniority, geographic location, performance, shift, travel requirements, sales or revenue metrics, collective bargaining agreements, and business needs.

Benefits

• Paid time off, medical, dental, and vision insurance, and a 401(k) for eligible employees.