Senior/Staff Security Developer

Dover

Winnipeg

Hybrid

CAD 99,000 - 121,000

Full time

11 days ago

Application generator

Turn this role into an interview — a resume and cover letter built around what this employer wants.

Get past ATS filters

Benefits offered by this job

Employee stock options

100% employer-covered health benefits

Flex-time & unlimited paid vacation

Gym membership

Catered lunches 3x per week

Dog-friendly office

Hybrid work model

Free parking on-site

Job summary

Taiv in Winnipeg, Canada, is seeking a Senior or Staff Security Developer to own security across field devices, the cloud infrastructure, and the deployment pipeline. This is a highly senior, hands-on position with no immediate direct reports, designed to scale as the company grows.

You will set security standards, shape posture, and drive incident response, threat modeling, and supply-chain security across production. Hybrid work is offered with strong growth potential at a YC-backed startup.

Job description

Who We Are:

Taiv is a fast-growing tech startup located in Winnipeg, Canada. Taiv uses AI to make business TV more fun, engaging, profitable, and easier to manage, starting with bars and restaurants. We've built proprietary tech that uses computer vision to watch live TV and improve the content with contextually-aware commercials, content, and games. Our tech also automates the manual AV tasks that venues have to do every day, to make bar management easier, standardized, and more profitable. We're venture-capital backed and graduated from Y Combinator, the world's top tech accelerator, in winter 2020. Program alumni include Airbnb, Instacart, DoorDash, etc. (www.ycombinator.com/topcompanies).

We are looking for a Senior or Staff Security Developer to join our growing team!

What We're Looking For:

You will own security across the devices in the field, the cloud infrastructure behind them, and the pipeline that ships code to both. We’re looking for someone to own the security of all of these items end to end, help set standards, and define and enforce security posture.

This is very senior hands on keyboard role, with no direct reports at the start. The expectation is that as we continue to grow and expand, the role adjusts.

What You'll Be Doing:

Own a private certificate authority and the device identity lifecycle: generation, provisioning, rotation, renewal, revocation, recovery. This service survives the loss of any one person or any one key.
Design and own how devices in the field prove their identity and what they are running.
Set and own the security baseline for production infrastructure, down to logging that someone actually reads and alerts on.
Build integrity and security into the path code takes to production: dependency and supply chain review, signed artifacts, etc.
Threat model anything touching device identity, customer data, or production access.
Help identify and triage findings. This includes translating into scoped tasks engineers across the company can pick up, then review what comes back.
Own incident response: the runbook, the decision rights, the containment call, and the writeup that keeps it from happening twice.
Lead the technical response when partners or auditors ask how we secure their data.
Own and manage our corporate MDM systems and internal security posture.

Who You Are:

You believe that technical security can coexist with productivity in the workplace. You’re conscious that just as security theatre is real, so is user fatigue.
You can write the code, read the diffs, and build the tooling yourself. You know when to use off the shelf tooling.
You want to keep your hands on the keyboard and not simply be a manager.
You have run a private certificate authority in production and have opinions about offline roots.
You have secured hardware that ships to customers that cannot be reached by hand when something goes wrong.
You turn vague risks into tasks engineers can pick up.
You can tell the difference between the thing that matters and the thing that fails a questionnaire, and you sequence the work accordingly.
You raise the security level of engineers who do not report to you.

Your Qualifications:

You have owned security architecture across both cloud infrastructure and a fleet of deployed devices.
You have designed and operated public key infrastructure, including certificate-based authentication and key storage on hardware.
You have led a security incident from detection through containment to the change that closed it out.

Nice To Have:

You have stood up a security team from nothing.
You have worked on hardware or manufacturing security: provisioning keys at manufacture, tamper detection, secure debug.
You have experience attending, participating, and ideally leading external client-facing meetings, as they pertain to your area of expertise.
You have public work we can read: talks, research, open source, advisories.

Perks: