Senior Security Engineer

Role & Team

We're looking to hire a Senior Security Engineer with excellent technical skills, strong security judgment, and effective communication skills.

This is a hands-on role for someone who can operate as both a security generalist and a strong full-stack engineer. You will help protect gaiia's products, infrastructure, customers, and teams by combining deep technical execution with pragmatic security leadership.

You will report to the Platform Lead and work closely with the Platform Lead and the CTO as thought partners. Together, you will help identify, prioritize, and execute the most important security work based on business criticality, customer impact, risk, and operational urgency.

This role is ideal for someone who can move fluidly between code, cloud infrastructure, product architecture, incident response, compliance, and team enablement, while staying grounded in practical business outcomes.

What is your team working on?

Technically speaking, you will work in a serverless ecosystem of microservices deployed on a cloud infrastructure. Gaiia is all-in on Typescript, with frontend, backend and infrastructure-as-code all leveraging Typescript.

As part of the security function, you will have the chance to work across five major axes:

Product and application security

Protect gaiia's products and customer-facing workflows by building security into design, development, testing, and remediation.

• Perform threat modelling and architecture reviews.
• Review authentication, authorization, tenant isolation and sensitive workflows.
• Review our secure-development standards and lightweight security reviews.
• Run internal penetration tests and work with developers on labelling issues and implementing remediations.
• Build and maintain a bug bounty program.

Cloud and infrastructure security

Strengthen the security of our cloud platforms, production environments, access model, deployment pipelines, and critical vendor configurations.

• Review AWS, Snowflake, GitHub and other critical vendors' configurations.
• Improve IAM, least privilege and production access for employees.
• Improve IAM, least privilege and production access for Lambdas and other cloud resources.
• Review logging, detection and cloud-security monitoring.
• Review infrastructure-as-code and deployment pipelines.
• Harden data stores, networks, backups and encryption controls.

Vulnerability and incident management

Create a clear operating model for finding, prioritizing, investigating, remediating, and learning from security issues and incidents.

• Own vulnerability intake, prioritization and remediation SLAs.
• Track root causes and ensure corrective actions are completed and satisfactory.
• Triage security alerts and coordinate investigations.
• Maintain incident-response plans and conduct exercises.
• Document escalation and communication procedures.

Governance, Risk and Compliance (GRC)

Maintain the policies, controls, evidence, and customer-facing security posture needed to meet regulatory, audit, sales, and legal expectations.

• Participate in the review and operation of current programs, including SOC 2, GDPR, and PCI.
• Coordinate auditors and external assessments.
• Help the Sales team with security questionnaires that they cannot answer confidently.
• Support the CTO in sales and legal negotiations involving security commitments.
• Review vendors and subprocessors' security controls.

Security enablement

Scale security across the company through training, guardrails, champions, roadmap planning, and leadership visibility.

• Build and enforce training for engineering and employees.
• Build reusable guardrails that scale without manually approving everything.
• Establish security champions across Engineering to aid in security initiatives.
• Maintain a prioritized security roadmap.
• Report material risks and progress to leadership.
• Participate in the long-term plan to build the security team.

Qualifications

Technical

• At least five (5) years of experience in Software Engineering, Application Security, Infrastructure Security, or a closely related technical role.
• Strong experience securing modern web applications, APIs, distributed systems, and cloud infrastructure.
• Strong experience with AWS.
• Strong experience with the JavaScript / TypeScript ecosystem.
• Experience with React.
• Experience working with microservices, serverless architectures, infrastructure-as-code, CI/CD pipelines, and production systems.
• Strong understanding of authentication, authorization, secrets management, IAM, logging, monitoring, and secure SDLC practices.
• Experience with penetration testing, bug bounty programs, SAST, dependency scanning, etc.

Personal

• Stellar judgement and pragmatism when making and implementing critical business decisions.
• Rigorous, calm, and level-headed approach to incidents, ambiguity, and high-stakes situations.
• Impressive communication skills, with the ability to coach, influence, and enable teams without slowing them down unnecessarily.
• Ability to prioritize security work based on business impact, customer risk, operational urgency, and engineering feasibility.
• Experience reviewing product architecture, identifying practical security risks, and partnering with engineering teams to implement effective mitigations.

Nice-to-haves

• You have experience with GraphQL.
• You have knowledge of telecom concepts.
• You have experience working on a System of Record.
• You have experience with compliance programs.
• You have experience supporting sales and legal conversations involving security commitments.
• You have experience building security programs in a high-growth SaaS company.

Salary

At gaiia, we have a transparent salary philosophy and a robust evaluation and compensation framework. It translates to a fair and impartial model where salaries are published internally, healthy discussions around compensation and performance can exist, and taboos are removed.

The salary range for this role is $130,000-$180,000.

Benefits

• Flexible 25 days vacation.
• Stock Options Plan.
• Group Insurance.
• Telemedicine.
• Life and Health Spending Accounts.
• Group Retirement Savings Plan (RRSP).
• Flexible working hours & all-remote work.

#LI-DNI