Staff Security Engineer

Staff Security Engineer

Location: Remote within Ontario or Quebec Canada.

Reports to: Head of Information Security and Technology Operations

About us

Trolley is the payouts platform for the internet economy. Our mission is to unlock the global economic opportunity of the internet by building a truly borderless payouts ecosystem.

Through our platform and API, Trolley enables businesses to pay people anywhere in the world, supporting creators, on-demand workers, and suppliers at scale. Companies rely on Trolley as mission-critical infrastructure to automate payouts, collect tax and banking information, and reduce fraud and risk, all in one place.

Today, Trolley is the trusted payouts solution for hundreds of businesses, including Canva, SoundCloud, and Envato. We've processed millions of payments globally, helping creators, artists, and suppliers get paid quickly, securely, and with confidence.

As Trolley enters its next stage of growth, we're investing heavily in AI to accelerate product innovation, improve operational efficiency, and transform how software is built across the company.

The Opportunity

Trolley moves money for hundreds of businesses and the people they pay around the world. That puts security at the centre of everything we do, and the attackers every payments company faces are now using AI to move faster. We're looking for a Staff Security Engineer to help us stay ahead of them.

This is a hands-on role. Your first priority is finding and closing security gaps in our product and infrastructure, working side by side with engineering teams on threat modelling, design reviews and fixes. Over time, the bulk of your work shifts to building: security controls in our AWS platform, shared tooling and automation that makes the secure way the easy way, and evidence that proves our controls work with as little chasing as possible. The rest goes into incident response and compliance, and helping our engineering teams build securely from the start. You'll shape how security engineering works at Trolley, with the backing to hold a release when a serious security issue calls for it. It's an individual contributor role, with no direct reports today.

You'll set security engineering priorities with your manager and engineering leads, then lead the work through to completion. Engineering teams own planned remediation in their systems; you'll provide hands-on support, guidance and coaching, pair on implementation, and verify that fixes address the risk. When an emergency security fix is needed, you'll step in and implement it directly.

What You'll Do

Design security

• Threat model new features and critical systems alongside our product engineering teams, early enough that what you find shapes the design.
• Review security-sensitive code changes alongside engineers, focusing on authorization, access to customer data, and payment flows.
• Set practical security standards for how we build, and turn them into defaults and tooling rather than checklists.
• Help shape our identity and access management (IAM) architecture, including SSO and MFA, as it evolves.

Build controls into the platform

• Build and maintain shared security tooling and CI/CD checks, including checks for exposed secrets and vulnerable dependencies.
• Automate vulnerability management so issues are found, owned and fixed quickly.
• Agree cloud security guardrails with our Infrastructure (SRE and DevOps) team, who run the platform, and work alongside them to make those guardrails the default in our AWS environment.

Defend against AI-enabled attackers

• Shrink the time we stay exposed to a newly disclosed vulnerability, and detect quickly when an attacker gets there first.
• Strengthen sign-in and account security, in our product and for our staff, against automated, AI-scaled account takeover attempts and bots, working with our product engineering teams.
• Make AI-generated phishing and impersonation harder to pull off, through phishing-resistant sign-in and verified approval steps for high-risk requests, working with our IT team.
• Use AI in your own work, within our AI usage policy, to detect, triage and respond faster.

Make compliance an engineering output

• Own the engineering side of our compliance programs, starting with SOC 2: controls you can verify in code, and evidence that collects itself wherever it can.
• Work with our Head of Information Security and Technology Operations, who owns policy, auditors and regulators, to support our compliance with the regulations that apply to us globally.
• Help answer customer security questionnaires and audit requests with the technical detail they need.

Detect, respond and test

• Lead the technical response to security incidents, working alongside our engineering on-call, and be the escalation point for serious ones.
• Provide the technical facts and timeline our regulatory reporting depends on.
• Improve logging and detection so we can identify and investigate attacks quickly.
• Run tabletop and purple-team exercises, and scope penetration tests, with outside specialists.

Raise the bar across engineering

• Grow a network of security champions with engineers who want to take it on.
• Help engineers find and fix security issues themselves, through reviews, pairing and short sessions.

In Your First Year

• Agreed priority security gaps in our product and infrastructure closed, with fixes verified and monitoring in place to check that the controls keep working.
• Threat models in place for our most critical systems, and a working agreement with each engineering team, the Infrastructure team included, on when security gets involved.
• A tabletop exercise completed with the leadership team, with owners and agreed next steps for the findings.
• More of our recurring compliance work, such as access reviews and control evidence, proven automatically instead of by hand.
• Security controls deployed in production to address agreed priority risks.

How You'll Work

• Collaborate with colleagues in Canada and the UK during overlapping working hours.
• A strong drive for execution, backed by clear documentation of architectural threat models, engineering choices, and acknowledged security tradeoffs.
• A lot of autonomy, with outside specialists for penetration testing and exercises.

What We're Looking For

Required Experience

• 8+ years in security or software engineering, including at least 5 years hands-on in security.
• You've built and run security controls in production environments, including logging and detection, and you've written code to automate security work (for example in TypeScript). Your depth is in at least one of application security, cloud security, or detection and response, with working knowledge of the others.
• You can read and debug production application code, implement and test security fixes, and deploy changes safely.
• You've run threat modelling and design reviews with product engineering teams.
• You've led the technical response to a security incident.
• You've turned a compliance requirement into an automated control or automated evidence.
• You can explain, with examples, how attackers are using AI in attacks such as phishing and account takeover, and which controls help. You use AI tools critically in your own work.
• You've got engineering teams to adopt security changes you don't control, and you're comfortable working with a lot of autonomy and making decisions through written proposals others can comment on.

Preferred Experience

• Payments, fintech or another regulated environment.
• Hands-on work with SOC 2, ISO 27001, PCI DSS or similar controls.
• Defending against account takeover, bots or fraud at scale.
• Designing authentication and access controls, including SSO with OIDC or SAML, OAuth authorization, and phishing-resistant MFA.
• Running tabletop, purple-team or red-team exercises, including with outside firms.
• Building integrations or automated checks for a compliance automation platform such as Vanta or Drata.
• Securing agentic systems or AI coding pipelines.

Our tech stack

• AWS (ECS, Fargate, Lambda, SNS, SQS, RDS, Bedrock), Docker, Terraform, CircleCI, Datadog, Cloudflare
• Node.js, TypeScript, React
• PostgreSQL, Redis

You don't need to know all of these. We expect you to learn what you haven't used.

Compensation

The expected base salary for this role is $162K CAD. Actual compensation will be determined based on factors such as experience, skills, qualifications, and overall fit for the role.

This job posting is for an existing vacancy.

What we offer

• Join an amazing team of diverse people working together on a common mission.
• Competitive salary
• ESOP Program: Meaningful equity and ownership that aligns your success with ours
• Extended healthcare benefits from Day 1.
• 4 weeks paid vacation per year + public holidays (+ 1 extra vacation day per year of service).
• 30 days remote work from anywhere.
• Gym membership allowance.
• 1/2 day Fridays off during summer.
• Company-provided use of Apple MacBook and Mac gear.

Use of AI in our hiring process

Trolley uses AI-assisted tools to help support certain aspects of our recruitment process, including screening and assessing applications against the qualifications and requirements of a role. These tools are designed to support our Talent Acquisition team and improve the efficiency and consistency of our hiring process. AI does not make final hiring decisions. All hiring decisions involve human review and judgment.