Senior Security Engineer

HeyOrca; United States; Remote; USD 57,000 - 95,000; Full time

Benefits offered by this job

3 weeks vacation

2 weeks Christmas holiday

Day off on your birthday

Home-office allowance

Ergonomic assessment allowance

Orca wellness plan

RRSP matching

Personal development allowance

Job summary

HeyOrca seeks a Senior Security Engineer to secure and harden a modern cloud platform using automation and AI-assisted practices. You will own the security of our cloud infrastructure, shaping design, deployment, and monitoring of AWS environments while enabling rapid shipping.

Collaborate with Engineering, Product, and Customer teams to protect data and maintain trust. The role offers growth in cloud security disciplines, architecture influence, and leadership development.

Qualifications

• 5+ years of experience in cloud security, infrastructure, DevSecOps, or a related security engineering role.
• Deep hands-on experience securing AWS environments (IAM, VPC, KMS, CloudTrail, GuardDuty, Security Hub, AWS Organizations).
• Experience with infrastructure-as-code tools such as Terraform or CloudFormation, and securing them through automated scanning and policy enforcement.
• Strong understanding of identity and access management, network security, and encryption in cloud environments.
• Experience with logging, monitoring, and detection tooling (e.g., SIEM platforms, CloudWatch).
• Hands-on experience using AI-assisted tools for security analysis, automation, or investigation.

Responsibilities

• Design, implement, and improve the security architecture of AWS environment with segmentation, encryption, and secrets management.
• Lead as cloud security evangelist across HeyOrca.
• Own IAM and enforce least-privilege access across accounts and services.
• Secure infrastructure-as-code with policy-as-code checks and guardrails in CI/CD.
• Build and tune logging, monitoring, and alerting for threat detection and response.
• Participate in cloud incident response and post-incident reviews.
• Manage vulnerability and patch management for cloud resources, containers, and hosts.
• Drive compliance readiness and evidence collection for SOC 2 and CIS Benchmarks.

Skills

AWS security

Terraform

IAM

Threat detection

AI-assisted security

Cloud security

Python scripting

Security automation

Tools

CloudFormation

CloudWatch

GuardDuty

KMS

SIEM

Job description

Newfoundland Time – Eastern Time | Canada
Application Deadline: Nov 23, 2026
Position Start Date: Jan 4, 2027
Compensation: Up to $135K CAD/year

About HeyOrca

HeyOrca is a fully remote company that values meaningful work and meaningful relationships. Our mission is to make marketing human by helping organizations build authentic communities.

We believe great software is built by people who care deeply about their craft, their teammates, and their customers. At HeyOrca, engineering is a collaborative, creative discipline - where speed, quality, and empathy are equally important.

The Role

We are seeking a Senior Security Engineer who thrives in a fast-moving, collaborative environment and is excited by the opportunity to secure and harden a modern cloud platform using automation and AI-assisted practices.

In this role, you will own the security of our cloud infrastructure - both internal and external, working alongside our engineering team to make secure-by-default the easiest path. You will help shape how we design, deploy, monitor, and defend our AWS environment—using AI not just as an aid, but as a force multiplier across threat detection, policy review, infrastructure analysis, and incident response. You will work closely with Engineering, Product, and Customer teams to protect customer data and maintain trust while enabling the team to ship quickly.

This role offers room to grow—whether that means deepening technical expertise across cloud security disciplines, expanding architectural influence, or developing leadership and mentorship skills.

While cloud security is the core, education and security evangelism are equally essential parts of the role. You will conduct lunch-n-learns and regularly contribute to elevating org-wide security knowledge and security-mindedness across all departments.

Key Responsibilities

As a Senior Security Engineer, you will:

• Design, implement, and continuously improve the security architecture of our AWS environment, including network segmentation, encryption, and secrets management
• Take lead as security evangelist and educator of all cloud properties and assets, across all departments in HeyOrca
• Own identity and access management, enforcing least‑privilege access across cloud accounts, services, and workloads
• Secure our infrastructure-as-code by embedding policy-as-code checks, misconfiguration scanning, and guardrails into CI/CD pipelines
• Build and tune logging, monitoring, and alerting to detect and respond to threats across our cloud environment
• Participate in cloud incident response, including investigation, containment, remediation, and blameless post‑incident reviews
• Manage vulnerability and patch management for cloud resources, containers, and host workloads
• Participate in threat modeling and security architecture reviews for new infrastructure and features
• Drive compliance readiness and evidence collection for frameworks such as SOC 2 and CIS Benchmarks, automating controls wherever possible
• Actively use AI tools for:
• • Accelerating the review of IAM policies, infrastructure code, and cloud configurations
  • Triaging alerts and analyzing logs to reduce noise and manual investigation
  • Exploring attack paths and identifying edge cases in cloud architecture
• Partner with developers to support secure application practices, including dependency scanning and secure deployment workflows
• Contribute to technical architecture decisions and long‑term platform evolution
• Participate in design discussions and team‑wide technical brainstorming sessions
• Communicate clearly and proactively—sharing context, risk tradeoffs, and progress with teammates
• Lead security awareness and training across the company for non‑technical people
• Assist with light IT management and security efforts related to employee endpoints

Qualifications

You bring:

• At least 5 years of experience in cloud security, infrastructure, DevSecOps, or a related security engineering role
• Deep hands‑on experience securing AWS environments, including services such as IAM, VPC, KMS, CloudTrail, GuardDuty, Security Hub, and AWS Organizations
• Experience with infrastructure‑as‑code tools such as Terraform or CloudFormation, and securing them through automated scanning and policy enforcement
• Strong understanding of identity and access management, network security, and encryption in cloud environments
• Experience with logging, monitoring, and detection tooling (e.g., SIEM platforms, CloudWatch, or similar)
• Hands‑on experience using AI‑assisted tools for security analysis, automation, or investigation
• Knowledge of security frameworks and best practices such as:
• • CIS Controls and CIS Benchmarks
  • SOC 2
  • OWASP Top 10
  • AWS Well‑Architected Framework (Security Pillar)
• Scripting or programming skills (e.g., Python, Bash, or TypeScript) for security automation
• Excellent problem‑solving skills

Nice to Have

• Experience securing containerized workloads (Docker, ECS, EKS, or Kubernetes)
• Experience with CI/CD pipeline security (e.g., GitHub Actions, supply chain security, secrets scanning)
• Familiarity with web application stacks such as PHP/Laravel, Node.js, or React
• Relevant certifications such as AWS Certified Security – Specialty, CCSP, or similar
• Experience leading a SOC 2 audit or similar compliance initiative
• Endpoint and corporate IT security experience
• Experience administering Google Workspace security and SaaS access governance
• Experience building a security awareness and training program

What You’ll Love About Working at HeyOrca

At HeyOrca, culture is not a side initiative—it’s central to how we work. We value curiosity, collaboration, and continuous improvement. We encourage engineers to learn, experiment, and share knowledge openly, including learning from AI‑generated code and making it part of their personal toolkit.

We believe diverse perspectives make better products, and we are committed to creating an inclusive, supportive workplace where every team member feels empowered to contribute.

Perks include:

• 3 weeks vacation
• 2 weeks Christmas holiday
• Day off on your birthday
• $500 home‑office allowance
• $300 ergonomic assessment allowance
• $500 yearly Orca wellness plan
• 5% RRSP matching
• $500/year personal development allowance

At HeyOrca, we are committed to building a diverse and inclusive workplace where every team member feels valued and empowered. We believe that our differences make us stronger and drive innovation. We welcome applications from people of all backgrounds, experiences, and perspectives. HeyOrca is an equal opportunity employer, and we do not discriminate on the basis of race, religion, colour, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.

Please note that we will only communicate with our job applicants by using @heyorca.com domains and no‑[e-mail] email. We will never contact applicants from any other email address. We will never ask for money or private information like SIN from potential employees. Be cautious of any unauthorized solicitations. You may view the most current and accurate job postings at https://www.heyorca.com/careers.