Senior Security Engineer - Roofr

At Roofr, we’re obsessed with our customers. We started by building essential sales tools like aerial roof measurements and digital sales proposals, and have since grown into a seamless, powerful CRM platform that connects these solutions with payments, material ordering, and more.

As a Senior Security Engineer, you'll report to the VP of Engineering and work closely with the CTO and DevOps as part of Roofr's security guild. You'll contribute directly to improving Roofr's security posture—sharpening what's already in place and driving it forward as the company scales. You'll own the tools and processes that detect and stop threats, partner with engineering on secure-by-design practices, and act as the front-line responder.

What You’ll Get to Do

• Security Infrastructure: Own the design and hardening of security infrastructure across cloud environments (network segmentation, firewalls, IDS/IPS, VPNs, WAF, and EDR).
• Vulnerability Management: Lead end-to-end vulnerability management, running assessments, triaging by exploitability/blast radius, and driving remediation SLAs with engineering.
• Detection & Response: Build and tune detection content (SIEM/SOAR rules, alerting logic) against real attack techniques. Act as incident commander for security incidents (containment, forensics, post-incident reviews).
• Threat Modeling: Threat-model new features and infrastructure changes before they ship to catch design-level risks.
• IAM & Cloud Security: Own IAM hygiene and cloud security posture (least privilege, key/secret management, network boundaries) across production AWS accounts.
• Compliance & Policy: Own Roofr's compliance program end-to-end, mapping controls to NIST CSF 2.0, SOC 2, and CCPA/CPRA. Write, enforce, and maintain security policies as living controls.
• Security Culture: Run tabletop exercises and push secure-by-design practices into engineering workflows.

What You’ll Bring to the Role

• Experience: 5-8+ years in security engineering, incident response, or related infrastructure roles, including time as the primary or senior responder on real incidents.
• Education: Bachelor's degree in Computer Science, IT, Cybersecurity, or equivalent hands-on experience.
• Network & Cloud Security: Deep understanding of network security fundamentals and hands-on cloud security experience in AWS (IAM, VPC, KMS, CloudTrail/GuardDuty).
• Incident Response: Real-world experience with triage, containment, forensics, and root cause analysis.
• Tooling & Code: Working knowledge of SIEM/SOAR tooling, writing detection logic (Python/Bash), and a strong software engineering mindset (comfortable reading and writing application code).
• Compliance: Fluent in compliance frameworks (NIST CSF 2.0, SOC 2, CCPA/CPRA) and translating controls into practical policies.
• Competencies: Confident being the sole security voice, calm under pressure, ownership-oriented, and a strong individual contributor who wants to stay hands-on.

Bonus Points

• Experience using AI/LLM tooling for threat intelligence (alert triage, detection summarization).
• Familiarity with GDPR.
• Experience with PHP/Laravel or Postgres.
• Certifications such as CISSP, OSCP, GCIH, or CEH.

What We Offer

• Mandatory PTO: Your first week of employment is mandatory PTO to decompress and recharge before starting in week 2.
• Flexible Time Off: Plus 1 Friday off per month ("laundry days") and a company-wide paid shutdown between Christmas and New Year’s.
• Health & Dental: 100% employer-paid premiums for Extended Healthcare and Dental in Canada (80% in the US).
• Financial Security: RRSP/401k match and equity options.
• Parental Leave: Generous parental leave policy.
• Stipends & Allowances: Home office setup stipend, plus internet and phone allowance.
• Growth: Ample learning and development opportunities.
• Culture: Remote-first culture with an annual company retreat.