1Password is hiring a Staff Security Engineer on the Security Incident Response team (remote within the US and Canada). The role focuses on leading high-severity incidents as an incident commander/technical lead, designing and building AI-assisted and automated security tooling, owning multi-quarter capability roadmaps, and running readiness programs such as tabletop exercises and gamedays. The posting lists an annual base salary range for US-based roles ($192,000–$278,000 USD) and for Canada-based roles (CAD ranges also provided in the posting). The position requires strong software engineering experience, experience with cloud-native/SaaS/identity-related attacks and response, threat hunting and insider-risk capability development, and strong written and verbal communication.

Senior Technical Architect (Security) for Professional Services responsible for designing and delivering secure GitLab architectures (SaaS, Self-Managed, Dedicated), conducting security risk assessments and threat modeling, leading CI/CD and security-tool migrations, and advising customers on compliance frameworks such as NIST 800-53, ISO 27001, and SOC 2. Role requires hands-on experience with infrastructure as code (Ansible, Terraform), GitLab security scanning capabilities, and integrating security controls into CI/CD pipelines.

Join Docker's security team to run adversary‑emulation exercises, penetration tests, and threat modeling across products and cloud infrastructure (AWS, GCP, Azure). The role requires building exploits and automated tests, partnering with engineering to remediate findings, improving security programs and tooling, and participating in incident response and on‑call rotations. Requires 3+ years in security engineering, hands‑on offensive experience, development in Python or Golang, and cloud/container security expertise.

Lead and conduct advanced security research and penetration testing across GitLab's platform and AI/agent surfaces, develop testing methodologies and tooling, validate vulnerabilities with proof-of-concept exploits, drive class-level remediations, mentor others, and coordinate cross-functional remediation. Role expects 10+ years' relevant experience and proficiency in two or more of Ruby, Go, Python, TypeScript, or Rust. US base salary range listed: $203,200–$275,000 USD (for US residents).

Lead the Device Infrastructure Services team as the technical owner of endpoint tooling, standards and roadmap. Require 7+ years IT/endpoint management experience (including 2+ years at senior/staff IC level), strong scripting and IaC skills (Bash, Python, Terraform), experience with GitOps, enterprise security fundamentals (encryption, patching, EDR, least-privilege, compliance), and practical use of AI to accelerate IT operations. Remote role for candidates in the United States or Canada; responsibilities include incident escalation, piloting tooling, partnering with Security and Product, and defining AI guardrails for device operations.

Work on Elastic's Security EDR Workflows team to design and implement Elastic Defend management and response-action capabilities, OSquery forensics, and APIs. Responsibilities include building scalable, high-performance systems, owning reliability and observability, writing production-grade TypeScript/Node.js code, collaborating across security, product, and design teams, and using AI to improve development. Compensation listed as CAD 128,300–203,000 (base).

Coinbase is hiring a Product Security Engineer to build, deploy, and maintain AI-augmented security scanners, lead red teaming of internal AI systems (prompt injection, jailbreak testing), and develop automation for vulnerability triage and remediation. Requires 3+ years' experience in application security/pen testing/offensive security, proficiency in a language such as Python or Go, and hands-on experience using LLMs/frontier models. Location: Remote - Canada. Reported base salary: 154,000 CAD/year.

Role requires 6+ years experience in attacker TTP analysis and building detections, 6+ years development in C, C++, and Python, deep OS internals and reverse-engineering skills, and experience developing performant, stable endpoint protections. Responsibilities include researching threats, adding endpoint visibility, writing production code, investigating telemetry at fleet scale, extending protections across platforms, mentoring, and publishing research. Salary range provided in CAD.

Lead and grow a distributed engineering team focused on endpoint protections (visibility, prevention, on-device ML) for Elastic Defend. Responsibilities include mentoring senior engineers, owning the roadmap and delivery, directing ML model work and telemetry, driving cross-platform protection parity (Windows, macOS, Linux), and representing the team in research and conferences. Requires hands-on security research, OS internals (kernel and user mode), malware analysis and reverse engineering experience, and people-leadership of senior technical contributors.

Lead two engineering teams owning Docker Build Cloud, Docker Hub Automated Builds, and SCS Services powering Docker Scout and Hardened Images. Requires demonstrated engineering leadership (5+ years managing teams, 8+ years professional engineering), strong backend and distributed-systems judgement, experience with CI/build systems and container workflows, and focus on software supply-chain security. Remote-first role (East Coast preferred) with hiring locations including Canada and the United States (England listed as a location in the posting).

GitLab seeks a Staff Corporate Security Engineer to architect and automate endpoint security across macOS, iOS, Windows, and Linux in a fully remote environment. The role emphasizes macOS endpoint hardening, Terraform and Infrastructure-as-Code practices, GitOps workflows, scripting for automation, and collaboration with IT, Security Operations, and detection teams to improve telemetry, detections, and auditability.

Role requires designing and implementing security primitives and a security control plane for omni-cloud and on-prem AI infrastructure. Responsibilities include building API-driven security services, automating enforcement via Infrastructure/Policy as Code, integrating security products (AuthN/AuthZ, secrets, scanning, IDS), conducting threat modeling, and collaborating with platform and product teams. Typical experience: 8+ years; Linux internals, Kubernetes, distributed systems, and production-grade coding expected.

Responsible for risk management (assessments, risk register, treatment tracking), compliance and audit support (evidence collection, SOC 2/ISMS/SoA), security program support (SSDLC, data classification, BC/DR, vulnerability management), and GRC operations/tooling administration. Typical experience 2–4 years with familiarity in SOC 2, ISO 27001 or NIST, hands-on GRC platform experience, and scripting/automation (e.g., Python, SQL).

Chromatic seeks a Senior DevOps Engineer to own and improve cloud infrastructure and security across its AWS-based rendering platform. The role requires 5+ years deploying and operating containerized applications, strong IaC experience with Terraform, CI/CD familiarity (CircleCI, GitHub Actions), networking and cloud security knowledge, and participation in on-call incident response. Position is fully remote for candidates based in the mainland US or Canada.

Lead architecture, design, and implementation of major security components in the Elasticsearch core engine, including authentication, authorization (scalable RBAC/ABAC), token validation, and data isolation. Optimize security performance for distributed systems, apply cryptographic solutions, drive vulnerability management with InfoSec, and mentor other engineers. Role lists a CAD base salary range and is based in Canada.

Lead and grow a team of engineers responsible for applications, tools and infrastructure that power security and detection capabilities. Collaborate with engineers, scientists and stakeholders to design and implement solutions for fraud and abuse mitigation; participate in code and architecture reviews; mentor engineers. Role expects 8+ years software engineering experience and 2+ years managing engineering teams, with experience in Typescript or Python, distributed systems, Kubernetes and Docker. Fully remote with flexible hours; locations listed include Poland, Canada, Argentina, Brazil, Mexico and Austria.

Quora seeks a Senior Software Engineer for its Security Engineering team to secure cloud infrastructure and compute platforms. Responsibilities include threat modeling, building and integrating security tooling (IaC, CI/CD, monitoring), hardening OS and cloud environments (AWS, Kubernetes), and participating in incident response. Role is remote-first and requires availability during Quora coordination hours (Mon-Fri 9am-3pm Pacific Time).

SearchApi seeks an experienced engineer to own the browser stack: patch browser engines (Chromium/Firefox) in C++, maintain per-OS fingerprint profiles, eliminate automation-detection signals (navigator, WebGL, canvas, audio, fonts, Client Hints, CDP leaks), and build tooling and tests to prevent regressions. The role requires deep reverse-engineering skills, familiarity with large browser build systems, and proven contributions to browser-engine patches or stealth tooling.

Responsible for owning the architecture and multi-quarter roadmap for Docker Hardened Images (security-hardened container images and Helm charts). Requires deep expertise in container/Kubernetes ecosystem, container supply chain security (SBOM, SLSA, Sigstore), distributed systems, and Go; role includes cross-team alignment, standards-setting, incident response, and mentorship.

NerdWallet seeks a Software Engineer (AI & Automation) within Security to design and build AI-enabled workflows (RAG, multi-agent systems), automated code-review and vulnerability analysis tools, production Python services/APIs, scalable ingestion/indexing pipelines, and integrations with engineering tools (GitHub, Slack, Jira, Confluence). The role emphasizes production experience with LLM APIs/agents, distributed/cloud systems, observability, testing, and applying security controls to AI applications. Remote across Canada (except Quebec).