Senior Security Engineer

gaiia; United States; Remoto; USD 130.000 - 180.000; Tempo integral

Benefícios oferecidos por esta vaga

Flexible 25 days vacation

Stock options

Group insurance

Telemedicine

Life and Health Spending Accounts

RRSP

Flexible working hours

All-remote work

Resumo da vaga

gaiia is seeking a Senior Security Engineer in the United States to blend security leadership with hands-on full-stack engineering. You will secure our products, infrastructure, and customers while collaborating with the Platform Lead and CTO to prioritize work based on risk and business impact.

This hands-on role covers product security, cloud security, incident response, and governance, with a strong emphasis on practical security outcomes. Remote-first with a fair compensation framework.

Qualificações

• Five or more years in software engineering, application security, or related field.
• Strong experience with modern web apps, APIs, distributed systems, and cloud infra.
• Proficient in AWS and the JavaScript/TypeScript ecosystem.
• Experience with React and microservices/serverless architectures.
• Familiarity with secure SDLC, IAM, logging, monitoring, and encryption controls.

Responsabilidades

• Perform threat modelling and architecture reviews across products.
• Review authentication, authorization, tenant isolation, and sensitive workflows.
• Run internal penetration tests and coordinate with developers on remediations.
• Build and maintain a bug bounty program.
• Own vulnerability intake, prioritization, and remediation SLAs.
• Coordinate security governance with SOC 2, GDPR, PCI and auditors.
• Develop security guardrails and enable security champions across engineering.
• Lead incident-response planning, drills, and post-incident reviews.

Conhecimentos

Software security engineering

Cloud security

Threat modelling

Security leadership

JavaScript/TypeScript

AWS security

Incident response

CI/CD security

Ferramentas

AWS

React

TypeScript

CI/CD pipelines

Infrastructure as Code

Bug bounty program

SAST

Dependency scanning

Descrição da vaga

Role & Team

We’re looking to hire a Senior Security Engineer with excellent technical skills, strong security judgment, and effective communication skills.

This is a hands-on role for someone who can operate as both a security generalist and a strong full-stack engineer. You will help protect gaiia’s products, infrastructure, customers, and teams by combining deep technical execution with pragmatic security leadership.

You will report to the Platform Lead and work closely with the Platform Lead and the CTO as thought partners. Together, you will help identify, prioritize, and execute the most important security work based on business criticality, customer impact, risk, and operational urgency.

This role is ideal for someone who can move fluidly between code, cloud infrastructure, product architecture, incident response, compliance, and team enablement, while staying grounded in practical business outcomes.

What is your team working on?

Technically speaking, you will work in a serverless ecosystem of microservices deployed on a cloud infrastructure. Gaiia is all-in on Typescript, with frontend, backend and infrastructure-as-code all leveraging Typescript.

As part of the security function, you will have the chance to work across five major axes:

Product and application security

• Perform threat modelling and architecture reviews.
• Review authentication, authorization, tenant isolation and sensitive workflows.
• Review our secure-development standards and lightweight security reviews.
• Run internal penetration tests and work with developers on labelling issues and implementing remediations.
• Build and maintain a bug bounty program.

Cloud and infrastructure security

• Review AWS, Snowflake, GitHub and other critical vendors’ configurations.
• Improve IAM, least privilege and production access for employees.
• Improve IAM, least privilege and production access for Lambdas and other cloud resources.
• Review logging, detection and cloud-security monitoring.
• Review infrastructure-as-code and deployment pipelines.
• Harden data stores, networks, backups and encryption controls.

Vulnerability and incident management

• Own vulnerability intake, prioritization and remediation SLAs.
• Track root causes and ensure corrective actions are completed and satisfactory.
• Triage security alerts and coordinate investigations.
• Maintain incident-response plans and conduct exercises.
• Document escalation and communication procedures.

Governance, Risk and Compliance (GRC)

• Participate in the review and operation of current programs, including SOC 2, GDPR, and PCI.
• Coordinate auditors and external assessments.
• Help the Sales team with security questionnaires that they cannot answer confidently.
• Support the CTO in sales and legal negotiations involving security commitments.
• Review vendors and subprocessors’ security controls.

Security enablement

• Build and enforce training for engineering and employees.
• Build reusable guardrails that scale without manually approving everything.
• Establish security champions across Engineering to aid in security initiatives.
• Maintain a prioritized security roadmap.
• Report material risks and progress to leadership.
• Participate in the long-term plan to build the security team.

Qualifications

Technical

• At least five (5) years of experience in Software Engineering, Application Security, Infrastructure Security, or a closely related technical role.
• Strong experience securing modern web applications, APIs, distributed systems, and cloud infrastructure.
• Strong experience with AWS.
• Strong experience with the JavaScript / TypeScript ecosystem.
• Experience with React.
• Experience working with microservices, serverless architectures, infrastructure-as-code, CI/CD pipelines, and production systems.
• Strong understanding of authentication, authorization, secrets management, IAM, logging, monitoring, and secure SDLC practices.
• Experience with penetration testing, bug bounty programs, SAST, dependency scanning, etc.

Personal

• Stellar judgement and pragmatism when making and implementing critical business decisions.
• Rigorous, calm, and level-headed approach to incidents, ambiguity, and high-stakes situations.
• Impressive communication skills, with the ability to coach, influence, and enable teams without slowing them down unnecessarily.
• Ability to prioritize security work based on business impact, customer risk, operational urgency, and engineering feasibility.
• Experience reviewing product architecture, identifying practical security risks, and partnering with engineering teams to implement effective mitigations.

Nice-to-haves

• You have experience with GraphQL.
• You have knowledge of telecom concepts.
• You have experience working on a System of Record.
• You have experience with compliance programs.
• You have experience supporting sales and legal conversations involving security commitments.
• You have experience building ****security programs in a high-growth SaaS company.

Salary

At gaiia, we have a transparent salary philosophy and a robust evaluation and compensation framework. It translates to a fair and impartial model where salaries are published internally, healthy discussions around compensation and performance can exist, and taboos are removed.

The salary range for this role is $130,000-$180,000.

Benefits

• Flexible 25 days vacation.
• Stock Options Plan.
• Group Insurance.
• Telemedicine.
• Life and Health Spending Accounts.
• Group Retirement Savings Plan (RRSP).
• Flexible working hours & all-remote work.

We are an equal-opportunity employer committed to inclusivity and diversity. Our workplace is fully remote and boasts accessible technologies, ensuring all team members can thrive. Should you require accommodations due to a disability during the application process, please contact us at 581-996-9639 or [e-mail] as per the Accessible Canada Act and human rights legislation. We’re here to support you every step of the way.

#LI-DNI