{"id":3768506,"url":"https://alion.io/job/trolley-staff-security-engineer","title":"Staff Security Engineer","company":{"id":32783,"name":"Trolley","domain":"trolley.ai","url":"https://alion.io/company/trolley","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":94,"open_postings":4,"ghost_share":0,"stale_share":0.25,"repost_share":0,"time_to_fill_p50_days":45,"computed_at":"2026-11-07T05:47:08Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Canada"],"countries":["CA"],"hiring_countries":["CA"],"hiring_countries_total":1,"salary":null,"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"IAM","optional":false},{"name":"SOC 2","optional":false},{"name":"TypeScript","optional":false},{"name":"AI Agents","optional":true},{"name":"Amazon ECS","optional":true},{"name":"AWS Bedrock","optional":true},{"name":"AWS Fargate","optional":true},{"name":"AWS Lambda","optional":true},{"name":"Canva","optional":true},{"name":"CircleCI","optional":true},{"name":"Cloudflare","optional":true},{"name":"Datadog","optional":true},{"name":"Docker","optional":true},{"name":"ISO 27001","optional":true},{"name":"JavaScript","optional":true},{"name":"Node JS","optional":true},{"name":"PCI DSS","optional":true},{"name":"PostgreSQL","optional":true},{"name":"React.js","optional":true},{"name":"Redis","optional":true},{"name":"Terraform","optional":true}],"status":"live","first_seen_at":"2026-11-04T19:12:14Z","employer_posted_date":"2026-11-04","last_verified_at":"2026-11-07T05:37:38Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Staff Security Engineer\nLocation: Remote within Ontario or Quebec Canada.\nReports to: Head of Information Security and Technology Operations\nAbout us\nTrolley is the payouts platform for the internet economy. Our mission is to unlock the global economic opportunity of the internet by building a truly borderless payouts ecosystem.\nThrough our platform and API, Trolley enables businesses to pay people anywhere in the world, supporting creators, on-demand workers, and suppliers at scale. Companies rely on Trolley as mission-critical infrastructure to automate payouts, collect tax and banking information, and reduce fraud and risk, all in one place.\nToday, Trolley is the trusted payouts solution for hundreds of businesses, including Canva, SoundCloud, and Envato. We've processed millions of payments globally, helping creators, artists, and suppliers get paid quickly, securely, and with confidence.\nAs Trolley enters its next stage of growth, we're investing heavily in AI to accelerate product innovation, improve operational efficiency, and transform how software is built across the company.\nThe Opportunity\nTrolley moves money for hundreds of businesses and the people they pay around the world. That puts security at the centre of everything we do, and the attackers every payments company faces are now using AI to move faster. We're looking for a Staff Security Engineer to help us stay ahead of them.\nThis is a hands-on role. Your first priority is finding and closing security gaps in our product and infrastructure, working side by side with engineering teams on threat modelling, design reviews and fixes. Over time, the bulk of your work shifts to building: security controls in our AWS platform, shared tooling and automation that makes the secure way the easy way, and evidence that proves our controls work with as little chasing as possible. The rest goes into incident response and compliance, and helping our engineering teams build securely from the start. You'll shape how security engineering works at Trolley, with the backing to hold a release when a serious security issue calls for it. It's an individual contributor role, with no direct reports today.\nYou'll set security engineering priorities with your manager and engineering leads, then lead the work through to completion. Engineering teams own planned remediation in their systems; you'll provide hands-on support, guidance and coaching, pair on implementation, and verify that fixes address the risk. When an emergency security fix is needed, you'll step in and implement it directly.\nWhat You'll Do\nDesign security\nThreat model new features and critical systems alongside our product engineering teams, early enough that what you find shapes the design.\nReview security-sensitive code changes alongside engineers, focusing on authorization, access to customer data, and payment flows.\nSet practical security standards for how we build, and turn them into defaults and tooling rather than checklists.\nHelp shape our identity and access management (IAM) architecture, including SSO and MFA, as it evolves.\nBuild controls into the platform\nBuild and maintain shared security tooling and CI/CD checks, including checks for exposed secrets and vulnerable dependencies.\nAutomate vulnerability management so issues are found, owned and fixed quickly.\nAgree cloud security guardrails with our Infrastructure (SRE and DevOps) team, who run the platform, and work alongside them to make those guardrails the default in our AWS environment.\nDefend against AI-enabled attackers\nShrink the time we stay exposed to a newly disclosed vulnerability, and detect quickly when an attacker gets there first.\nStrengthen sign-in and account security, in our product and for our staff, against automated, AI-scaled account takeover attempts and bots, working with our product engineering teams.\nMake AI-generated phishing and impersonation harder to pull off, through phishing-resistant sign-in and verified approval steps for high-risk requests, working with our IT team.\nUse AI in your own work, within our AI usage policy, to detect, triage and respond faster.\nMake compliance an engineering output\nOwn the engineering side of our compliance programs, starting with SOC 2: controls you can verify in code, and evidence that collects itself wherever it can.\nWork with our Head of Information Security and Technology Operations, who owns policy, auditors and regulators, to support our compliance with the regulations that apply to us globally.\nHelp answer customer security questionnaires and audit requests with the technical detail they need.\nDetect, respond and test\nLead the technical response to security incidents, working alongside our engineering on-call, and be the escalation point for serious ones.\nProvide the technical facts and timeline our regulatory reporting depends on.\nImprove logging and detection so we can identify and investigate attacks quickly.\nRun tabletop and purple-team exercises, and scope penetration tests, with outside specialists.\nRaise the bar across engineering\nGrow a network of security champions with engineers who want to take it on.\nHelp engineers find and fix security issues themselves, through reviews, pairing and short sessions.\nIn Your First Year\nAgreed priority security gaps in our product and infrastructure closed, with fixes verified and monitoring in place to check that the controls keep working.\nThreat models in place for our most critical systems, and a working agreement with each engineering team, the Infrastructure team included, on when security gets involved.\nA tabletop exercise completed with the leadership team, with owners and agreed next steps for the findings.\nMore of our recurring compliance work, such as access reviews and control evidence, proven automatically instead of by hand.\nSecurity controls deployed in production to address agreed priority risks.\nHow You'll Work\nCollaborate with colleagues in Canada and the UK during overlapping working hours.\nA strong drive for execution, backed by clear documentation of architectural threat models, engineering choices, and acknowledged security tradeoffs.\nA lot of autonomy, with outside specialists for penetration testing and exercises.\nWhat We're Looking For\nRequired Experience\n8+ years in security or software engineering, including at least 5 years hands-on in security.\nYou've built and run security controls in production environments, including logging and detection, and you've written code to automate security work (for example in TypeScript). Your depth is in at least one of application security, cloud security, or detection and response, with working knowledge of the others.\nYou can read and debug production application code, implement and test security fixes, and deploy changes safely.\nYou've run threat modelling and design reviews with product engineering teams.\nYou've led the technical response to a security incident.\nYou've turned a compliance requirement into an automated control or automated evidence.\nYou can explain, with examples, how attackers are using AI in attacks such as phishing and account takeover, and which controls help. You use AI tools critically in your own work.\nYou've got engineering teams to adopt security changes you don't control, and you're comfortable working with a lot of autonomy and making decisions through written proposals others can comment on.\nPreferred Experience\nPayments, fintech or another regulated environment.\nHands-on work with SOC 2, ISO 27001, PCI DSS or similar controls.\nDefending against account takeover, bots or fraud at scale.\nDesigning authentication and access controls, including SSO with OIDC or SAML, OAuth authorization, and phishing-resistant MFA.\nRunning tabletop, purple-team or red-team exercises, including with outside firms.\nBuilding integrations or automated checks for a compliance automation platform such as Vanta or Drata.\nSecuring agentic systems or AI coding pipelines.\nOur tech stack\nAWS (ECS, Fargate, Lambda, SNS, SQS, RDS, Bedrock), Docker, Terraform, CircleCI, Datadog, Cloudflare\nNode.js, TypeScript, React\nPostgreSQL, Redis\nYou don't need to know all of these. We expect you to learn what you haven't used.\nCompensation\nThe expected base salary for this role is $162K CAD. Actual compensation will be determined based on factors such as experience, skills, qualifications, and overall fit for the role.\nThis job posting is for an existing vacancy.\nWhat we offer\nJoin an amazing team of diverse people working together on a common mission.\nCompetitive salary\nESOP Program: Meaningful equity and ownership that aligns your success with ours\nExtended healthcare benefits from Day 1.\n4 weeks paid vacation per year + public holidays (+ 1 extra vacation day per year of service).\n30 days remote work from anywhere.\nGym membership allowance.\n1/2 day Fridays off during summer.\nCompany-provided use of Apple MacBook and Mac gear.\nUse of AI in our hiring process\nTrolley uses AI-assisted tools to help support certain aspects of our recruitment process, including screening and assessing applications against the qualifications and requirements of a role. These tools are designed to support our Talent Acquisition team and improve the efficiency and consistency of our hiring process. AI does not make final hiring decisions. All hiring decisions involve human review and judgment.","description_format":"text","description_chars":9376,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Apple Macbook","Equity","Gym membership"],"hiring_locations":[{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Financial Software & Embedded Finance","Payment Processing & Gateways"],"lifecycle":[{"event":"open","at":"2026-11-04T20:53:15Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":2,"expected_fill_days":45,"reasons":["conf:0","velocity","win:early"],"computed_at":"2026-11-07T05:47:08Z"},"pay":null,"html_url":"https://alion.io/job/trolley-staff-security-engineer","json_url":"https://alion.io/job/trolley-staff-security-engineer.json","meta":{"generated_at":"2026-11-07T07:24:50Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2492,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-08T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":32783},"rest":"https://alion.io/mcp/rest/get_company?id=32783"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftrolley-staff-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftrolley-staff-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftrolley-staff-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/trolley-staff-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftrolley-staff-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3768506}},{"tool":"search_jobs","arguments":{"company":"trolley.ai","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3768506},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}