[Hiring] Senior Security Engineer @HeyOrca

Role Description

We are seeking a Senior Security Engineer who thrives in a fast-moving, collaborative environment and is excited by the opportunity to secure and harden a modern cloud platform using automation and AI-assisted practices. In this role, you will own the security of our cloud infrastructure - both internal and external, working alongside our engineering team to make secure-by-default the easiest path. You will help shape how we design, deploy, monitor, and defend our AWS environment—using AI not just as an aid, but as a force multiplier across threat detection, policy review, infrastructure analysis, and incident response. You will work closely with Engineering, Product, and Customer teams to protect customer data and maintain trust while enabling the team to ship quickly.

This role offers room to grow—whether that means deepening technical expertise across cloud security disciplines, expanding architectural influence, or developing leadership and mentorship skills. While cloud security is the core, education and security evangelism are equally essential parts of the role. You will conduct lunch-n-learns and regularly contribute to elevating org-wide security knowledge and security-mindedness across all departments.

Key Responsibilities

• Design, implement, and continuously improve the security architecture of our AWS environment, including network segmentation, encryption, and secrets management
• Take lead as security evangelist and educator of all cloud properties and assets, across all departments in HeyOrca
• Own identity and access management, enforcing least-privilege access across cloud accounts, services, and workloads
• Secure our infrastructure-as-code by embedding policy-as-code checks, misconfiguration scanning, and guardrails into CI/CD pipelines
• Build and tune logging, monitoring, and alerting to detect and respond to threats across our cloud environment
• Participate in cloud incident response, including investigation, containment, remediation, and blameless post-incident reviews
• Manage vulnerability and patch management for cloud resources, containers, and host workloads
• Participate in threat modeling and security architecture reviews for new infrastructure and features
• Drive compliance readiness and evidence collection for frameworks such as SOC 2 and CIS Benchmarks, automating controls wherever possible
• Actively use AI tools for:
  • Accelerating the review of IAM policies, infrastructure code, and cloud configurations
  • Triaging alerts and analyzing logs to reduce noise and manual investigation
  • Exploring attack paths and identifying edge cases in cloud architecture
• Partner with developers to support secure application practices, including dependency scanning and secure deployment workflows
• Contribute to technical architecture decisions and long-term platform evolution
• Participate in design discussions and team-wide technical brainstorming sessions
• Communicate clearly and proactively—sharing context, risk tradeoffs, and progress with teammates
• Lead security awareness and training across the company for non-technical people
• Assist with light IT management and security efforts related to employee endpoints

Qualifications

• At least 5 years of experience in cloud security, infrastructure, DevSecOps, or a related security engineering role
• Deep hands-on experience securing AWS environments, including services such as IAM, VPC, KMS, CloudTrail, GuardDuty, Security Hub, and AWS Organizations
• Experience with infrastructure-as-code tools such as Terraform or CloudFormation, and securing them through automated scanning and policy enforcement
• Strong understanding of identity and access management, network security, and encryption in cloud environments
• Experience with logging, monitoring, and detection tooling (e.g., SIEM platforms, CloudWatch, or similar)
• Hands-on experience using AI-assisted tools for security analysis, automation, or investigation
• Knowledge of security frameworks and best practices such as:
  • CIS Controls and CIS Benchmarks
  • SOC 2
  • OWASP Top 10
  • AWS Well-Architected Framework (Security Pillar)
• Scripting or programming skills (e.g., Python, Bash, or TypeScript) for security automation
• Excellent problem-solving skills

Nice to Have

• Experience securing containerized workloads (Docker, ECS, EKS, or Kubernetes)
• Experience with CI/CD pipeline security (e.g., GitHub Actions, supply chain security, secrets scanning)
• Familiarity with web application stacks such as PHP/Laravel, Node.js, or React
• Relevant certifications such as AWS Certified Security – Specialty, CCSP, or similar
• Experience leading a SOC 2 audit or similar compliance initiative
• Endpoint and corporate IT security experience
• Experience administering Google Workspace security and SaaS access governance
• Experience building a security awareness and training program

Benefits

• 3 weeks vacation
• 2 weeks Christmas holiday
• Day off on your birthday
• $500 home-office allowance
• $300 ergonomic assessment allowance
• $500 yearly Orca wellness plan
• 5% RRSP matching
• $500/year personal development allowance

Company Description

At HeyOrca, culture is not a side initiative—it’s central to how we work. We value curiosity, collaboration, and continuous improvement. We encourage engineers to learn, experiment, and share knowledge openly, including learning from AI-generated code and making it part of their personal toolkit.

We believe diverse perspectives make better products, and we are committed to creating an inclusive, supportive workplace where every team member feels empowered to contribute.

At HeyOrca, we are committed to building a diverse and inclusive workplace where every team member feels valued and empowered. We believe that our differences make us stronger and drive innovation. We welcome applications from people of all backgrounds, experiences, and perspectives. HeyOrca is an equal opportunity employer, and we do not discriminate on the basis of race, religion, colour, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.

Please note that we will only communicate with our job applicants by using @heyorca.com domains and [email protected] email. We will never contact applicants from any other email address. We will never ask for money or private information like SIN from potential employees. Be cautious of any unauthorized solicitations. You may view the most current and accurate job postings at HeyOrca by visiting HeyOrca Careers .