Staff Security Engineer

Trolley

. Find and close security gaps in Trolley’s product and infrastructure .

Posted 11/4/2026full-timeRemote • CanadaLead💰 CA$162,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in security engineering, including threat modeling, vulnerability management, and compliance with global regulations. Proficient in automating security controls and enhancing application and cloud security while collaborating effectively with cross-functional teams.

Highest-signal resume keywords

Security EngineeringThreat ModelingVulnerability ManagementCompliance AutomationApplication Security

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Security ControlsCode AutomationLogging and DetectionSecurity Fix ImplementationIncident ResponseAI in SecurityPenetration TestingSecurity StandardsIAM ArchitectureSSO and MFA

Soft Skills

CollaborationAutonomous Decision-MakingTraining and Mentoring

Tools & Technologies

AWSCI/CDTypeScriptSecurity ToolingAI Tools

Certifications & Qualifications

SOC 2 Compliance

Industry Keywords

Cloud SecurityApplication SecurityDetection and ResponseSecurity Incident ManagementPhishing Resistance

Tech Stack

Tools & technologies

AWSCloudTypeScript

About the role

Key responsibilities & impact

Find and close security gaps in Trolley’s product and infrastructure
Conduct threat modelling and security-sensitive code reviews with product engineering teams
Set practical security standards and turn them into defaults and tooling
Help shape IAM architecture, including SSO and MFA
Build and maintain shared security tooling and CI/CD checks for exposed secrets and vulnerable dependencies
Automate vulnerability management
Establish cloud security guardrails with Infrastructure, SRE, and DevOps teams in AWS
Reduce exposure time to newly disclosed vulnerabilities and detect attacks quickly
Strengthen product and staff sign-in and account security against account takeover and bots
Make AI-generated phishing and impersonation harder through phishing-resistant sign-in and verified approval steps
Use AI to detect, triage, and respond faster within the AI usage policy
Own the engineering side of compliance programs, starting with SOC 2
Support compliance with applicable global regulations and answer customer security questionnaires and audit requests
Lead technical responses to security incidents and provide facts and timelines for regulatory reporting
Improve logging and detection
Run tabletop and purple-team exercises and scope penetration tests
Grow a network of security champions and help engineers fix security issues through reviews, pairing, and training
Set security engineering priorities with the manager and engineering leads and lead work through completion
Verify remediation fixes address the underlying risk

Requirements

What you’ll need

8+ years in security or software engineering, including at least 5 years hands-on in security
Built and run security controls in production environments, including logging and detection
Written code to automate security work, for example in TypeScript
Depth in at least one of application security, cloud security, or detection and response, with working knowledge of the others
Ability to read and debug production application code, implement and test security fixes, and deploy changes safely
Experience running threat modelling and design reviews with product engineering teams
Experience leading the technical response to a security incident
Experience turning a compliance requirement into an automated control or automated evidence
Ability to explain how attackers use AI in phishing and account takeover, which controls help, and use AI tools critically
Experience getting engineering teams to adopt security changes without direct control
Comfortable working autonomously and making decisions through written proposals
Able to collaborate with colleagues in Canada and the UK during overlapping working hours

Benefits

Comp & perks

Competitive salary
ESOP Program: Meaningful equity and ownership that aligns your success with ours
Extended healthcare benefits from Day 1
4 weeks paid vacation per year + public holidays (+ 1 extra vacation day per year of service)
30 days remote work from anywhere
Gym membership allowance
1/2 day Fridays off during summer
Company-provided use of Apple MacBook and Mac gear