Staff Security Engineer, Infrastructure Security (Americas)

Shopify; United States; On-site; USD 150,000 - 190,000; Full time

Job summary

Shopify is seeking a Staff Security Engineer to lead the security of cloud infrastructure and production runtimes at scale. You will set direction across cloud platforms, IaC security, IAM, and Kubernetes, reducing risk while enabling engineers to ship quickly and securely.

You will drive security strategy, architect scalable controls, and mentor engineers through reviews and pairing. This role demands deep cloud security expertise, strong collaboration, and a bias for practical, repeatable

Qualifications

• Experience leading security for large-scale cloud environments.
• Ability to translate complex security concepts into practical controls.
• Experience with Kubernetes, IaC, and IAM design.
• Strong collaboration with engineering and product teams.

Responsibilities

• Define and drive security strategy for production runtimes.
• Architect and implement scalable security controls in production.
• Lead threat hunts, tabletop exercises, and incident reviews.
• Create repeatable security patterns and self-service tooling.
• Mentor engineers through reviews and guidance.
• Communicate security trade-offs to technical and non-technical partners.

Skills

Cloud security

Kubernetes security

IaC security

IAM

Threat hunting

Security reviews

Programming / coding

Communication

Leadership

Job description

About The Role

Shopify is looking for a Staff Security Engineer to lead the security of cloud infrastructure and production runtimes at scale. You’ll set direction across cloud platforms, infrastructure as code, identity and access management, and Kubernetes—reducing risk while helping engineering teams ship quickly and securely. Our mission is to proactively defend Shopify’s production runtimes and build scalable, reproducible security solutions.

About The Role

Shopify is looking for a Staff Security Engineer to lead the security of cloud infrastructure and production runtimes at scale. You’ll set direction across cloud platforms, infrastructure as code, identity and access management, and Kubernetes—reducing risk while helping engineering teams ship quickly and securely. Our mission is to proactively defend Shopify’s production runtimes and build scalable, reproducible security solutions.

About You

You’ll be effective in this role if you’re comfortable navigating ambiguity, exercising independent judgment, and turning complex security problems into practical, scalable solutions. You communicate clearly with technical and non-technical partners and engage constructively with disagreement.

Your Key Areas of Ownership

• Cloud and infrastructure security posture — Set direction for securing Shopify’s production runtimes at scale, identify meaningful gaps in our security posture, and drive measurable risk reduction. Use data to quantify control effectiveness, detection outcomes, and engineering velocity, then use those signals to set priorities and communicate progress.
• Scalable security controls and operational readiness — Build, operate, and validate controls that reduce manual work and unnecessary complexity; lead threat hunts, tabletop exercises, and post-incident reviews, turning findings into improved playbooks and repeatable practices.
• Cross-company security leadership — Trailblaze Shopify’s approach to emerging cloud and infrastructure security risks, represent the domain in cross-company strategy, and set the pace for secure delivery while raising the bar for the security discipline.

You Will

• Identify material gaps in cloud-security capabilities, provide architectural guidance and security reviews, and drive prioritized remediation from proposal through adoption.
• Design, implement, and validate infrastructure security controls in production; turn recurring guidance into reusable, self-service patterns, tooling, and documentation.
• Initiate complex security projects, involve stakeholders at the appropriate level, ship iteratively, and prioritize high-leverage improvements.
• Maintain meticulous documentation for security controls, architecture decisions, incident learnings, and playbooks so teams can operate and improve systems without losing context.
• Stay ahead of changes in the threat landscape, perform threat hunts, research emerging technologies, and translate findings into practical improvements.
• Communicate security concepts and tradeoffs clearly to technical partners, non-technical stakeholders, and senior leadership.
• Mentor engineers through pairing, code reviews, technical guidance, and knowledge sharing.

To Be Successful

• You have been a technical security leader in a large-scale, complex, cloud-based environment and can use analytical and data-literacy skills to shape a security roadmap.
• You have deep expertise securing cloud infrastructure at scale, with experience applying security principles to infrastructure as code, identity and access management, and Kubernetes environments.
• You have designed and operated infrastructure security controls from implementation through production adoption, and can measure their effectiveness.
• You have experience building and operating production security tooling, with fluency in at least one programming language and the ability to work effectively with infrastructure as code, cloud APIs, and Kubernetes configuration.
• You can assess attack surfaces as an adversary would and use proactive techniques to build detections and close gaps before they are exploited.
• You have a track record of independently delivering complex security initiatives, influencing senior stakeholders, and integrating security roadmaps with broader company priorities.
• You can collaborate across teams during high-stress situations, manage competing priorities, and use good judgment to establish order.
• You use AI reflexively to accelerate cloud-risk analysis, infrastructure-as-code review, security-control design, and scalable infrastructure-security solutions—applying sound judgment to validate its outputs.
• You demonstrate a strong sense of accountability: taking responsibility for the quality, adoption, and outcomes of security controls and initiatives, surfacing risks early, and driving them to resolution.

Nice to Have

• Familiarity with application-security practices and security threats related to e-commerce.

About Shopify

Opportunity is not evenly distributed. Shopify puts independence within reach for anyone with a dream to start a business. We propel entrepreneurs and enterprises to scale the heights of their potential. Since 2006, we’ve grown to over 8,300 employees and generated over $1 trillion in sales for millions of merchants in 175 countries.

This is life-defining work that directly impacts people’s lives as much as it transforms your own. This is putting the power of the few in the hands of the many, is a future with more voices rather than fewer, and is creating more choices instead of an elite option.

About You

Moving at our pace brings a lot of change, complexity, and ambiguity—and a little bit of chaos. Shopifolk thrive on that and are comfortable being uncomfortable. That means Shopify is not the right place for everyone.

Before you apply, consider if you can:

• Care deeply about what you do and about making commerce better for everyone
• Excel by seeking professional and personal hypergrowth
• Keep up with an unrelenting pace (the week, not the quarter)
• Be resilient and resourceful in face of ambiguity and thrive on (rather than endure) change
• Bring critical thought and opinion
• Put AI agents and tools to work on the tasks they're built for, and focus on the work only humans can do
• Embrace differences and disagreement to get shit done and move forward
• Work digital-first for your daily work

We may use AI-enabled tools to screen, select, and assess applications. All AI outputs are reviewed and validated by our recruitment team.