Staff Security Engineer (Fintech)

Location: Remote within Ontario or Quebec, Canada. Overlapping working hours with colleagues in Canada and the UK are required.

Base salary: $162K CAD per year.

Company

hirify.global provides a payouts platform and API for internet businesses, automating payments, tax and banking information collection, fraud reduction, and risk management.

What you will do

• Threat-model critical systems, review security-sensitive code, and guide authorization, customer-data access, payment-flow, IAM, SSO, and MFA design.
• Build shared security tooling, CI/CD checks, vulnerability-management automation, and AWS security guardrails with Infrastructure, SRE, and DevOps teams.
• Defend against AI-scaled account takeover, bots, phishing, impersonation, and newly disclosed vulnerabilities.
• Own the engineering side of SOC 2 and related compliance work, including automated controls, evidence collection, questionnaires, and audit requests.
• Lead technical incident response, improve logging and detection, and run tabletop, purple-team, and penetration-testing exercises.
• Develop security champions and help engineering teams implement secure fixes through reviews, pairing, and coaching.

Requirements

• 8+ years in security or software engineering, including at least 5 years of hands-on security experience.
• Production experience building and operating security controls, including logging and detection, plus code-based security automation; depth in application security, cloud security, or detection and response and working knowledge of the others.
• Ability to read and debug production application code, implement and test security fixes, and deploy changes safely.
• Experience running threat modelling and design reviews with product engineering teams and leading technical security-incident response.
• Experience converting compliance requirements into automated controls or evidence.
• Ability to explain AI-enabled phishing and account-takeover techniques, effective controls, and critical use of AI tools.
• Experience gaining adoption for security changes without direct authority, working autonomously, and making decisions through written proposals.
• Ability to work overlapping hours with colleagues in Canada and the UK.

Nice to have

• Payments, fintech, or other regulated-environment experience.
• Hands-on SOC 2, ISO 27001, PCI DSS, or similar controls experience.
• Experience defending against account takeover, bots, or fraud at scale.
• Authentication and access-control design, including OIDC or SAML SSO, OAuth authorization, and phishing-resistant MFA.
• Tabletop, purple-team, or red-team exercise experience, including work with outside firms.
• Integrations or automated checks for Vanta, Drata, or a similar compliance automation platform.
• Experience securing agentic systems or AI coding pipelines.

Culture & Benefits

• High-autonomy individual-contributor role reporting to the Head of Information Security and Technology Operations, with no direct reports currently.
• Work with engineering teams in Canada and the UK, supported by outside specialists for penetration testing and exercises.
• Extended healthcare benefits from day one, four weeks of paid vacation, public holidays, and an additional vacation day per year of service.
• 30 days of remote work from anywhere, gym membership allowance, and half-day Fridays during summer.
• ESOP program and company-provided Apple MacBook and accessories.