Senior Security Engineer

Socket.dev; Toronto; On-site; CAD 110,000 - 150,000; Full time

Job summary

Forma.ai is seeking a Senior Security Engineer to lead hands-on security across cloud and product lifecycles. You'll collaborate with Engineering, DevOps, IT, and Privacy to identify risks and design practical controls to ship secure software.

The role offers opportunities to evolve into an IC or build a security team, depending on interests and business needs.

Qualifications

• Experience securing cloud-based workloads.
• Strong understanding of IAM and least-privilege models.
• Experience with secure development lifecycle practices.

Responsibilities

• Design and implement security controls across Forma's AWS environments, with a focus on IAM, least-privilege access, service identities, and account boundaries.
• Embed security requirements into Terraform and other Infrastructure as Code, and improve secrets, certificate, encryption-key, and credential management.
• Build automated checks for insecure configurations, excessive permissions, exposed resources, and configuration drift across Kubernetes, containers, serverless workloads, networking, and data services.

Job description

About Forma.ai:

Forma.ai is a Series B startup that's revolutionizing how sales compensation is designed, managed and optimized. We handle billions in annual managed commissions for market leaders like Edmentum, Stryker, and Autodesk.

Our growth has been fuelled by our passion for fundamentally changing and shaping how companies use sales intelligence to drive business strategy.

We’re welcoming equally driven individuals who are excited about creating something big!

The Opportunity

As a Senior Security Engineer, you will be a hands-on technical leader strengthening security across Forma's application, cloud infrastructure, development lifecycle, internal systems, and incident-response practices.

Security today is shared across Engineering and DevOps. You'll work closely with both teams and have real room to shape how Forma approaches security as we grow. Depending on your interests and the needs of the business, the role could develop into a deeper individual-contributor position or help build a dedicated security team.

You'll work directly with Engineering, DevOps, IT, Product, Legal, and Privacy to identify risks, design practical controls, automate security processes, and help teams ship secure and reliable software.

What you'll do

Cloud and infrastructure security

• Design and implement security controls across Forma's AWS environments, with a focus on IAM, least-privilege access, service identities, and account boundaries.
• Embed security requirements into Terraform and other Infrastructure as Code, and improve secrets, certificate, encryption-key, and credential management.
• Build automated checks for insecure configurations, excessive permissions, exposed resources, and configuration drift across Kubernetes, containers, serverless workloads, networking, and data services.

Application, data, and AI security

• Run threat modelling and security architecture reviews for new products, services, APIs, data pipelines, and third-ty [truncated due to length]