Staff Security Engineer
New
T
TrolleyPayments, fintech
Remote within Ontario or Quebec Canada., Collaborate with colleagues in Canada and the UK during overlapping working hours.Full-TimeStaff
Salary162,000 CAD per year
Apply NowOpens the employer's application page
Job Details
- Experience
- 8+ years in security or software engineering, including at least 5 years hands-on in security.
- Required Skills
- AWSTypeScript
Requirements
- Have 8+ years in security or software engineering, including at least 5 years of hands-on security experience.
- Have built and run production security controls, including logging and detection.
- Have written code to automate security work, for example in TypeScript.
- Have depth in at least one of application security, cloud security, or detection and response, with working knowledge of the others.
- Be able to read and debug production application code, implement and test security fixes, and deploy changes safely.
- Have run threat modelling and design reviews with product engineering teams.
- Have led the technical response to a security incident.
- Have turned a compliance requirement into an automated control or automated evidence.
- Be able to explain how attackers use AI in attacks such as phishing and account takeover, and which controls help; use AI tools critically.
- Have driven engineering teams to adopt security changes and be comfortable working autonomously and making decisions through written proposals.
- Preferred: experience in payments, fintech, or another regulated environment, and hands-on work with SOC 2, ISO 27001, PCI DSS, or similar controls.
- Preferred: experience with account-takeover, bot, or fraud defense; authentication and access controls; security exercises; compliance automation platforms; or securing agentic systems or AI coding pipelines.
Responsibilities
- Threat model new features and critical systems with product engineering teams, early enough to influence design.
- Review security-sensitive code changes, focusing on authorization, customer-data access, and payment flows.
- Build and maintain shared security tooling and CI/CD checks, including exposed-secret and vulnerable-dependency checks.
- Automate vulnerability management and establish cloud security guardrails in the AWS environment with the Infrastructure team.
- Strengthen product and staff sign-in and account security against account takeover attempts and bots.
- Own the engineering side of compliance programs, starting with SOC 2, and automate controls and evidence collection where possible.
- Lead technical responses to security incidents and provide facts and timelines for regulatory reporting.
- Improve logging and detection, and run tabletop and purple-team exercises and scope penetration tests.
- Help engineers identify and fix security issues through reviews, pairing, and short sessions.
View Full Description & ApplyYou'll be redirected to the employer's site
