Senior Infrastructure Security Engineer

As a Senior Security Engineer on the Infrastructure Security team, you will utilize your deep expertise in security, along with your understanding of cloud platforms and container technologies, to enhance our overall security posture. Your efforts will focus on minimizing risks to our systems and data while addressing complex engineering challenges at scale. Our mission is to guarantee the security of our production environments by proactively defending against potential threats.

Responsibilities

• Build robust and secure systems that reduce risk, are durable and future-proof the Shopify platform. Understand where our capabilities are lacking, and execute on identified areas of improvement to drive impact. Produce solutions that are easy to understand, operate and maintain.
• Increase velocity by removing complexity, and deliver results by identifying areas where we can improve security.
• Strive for quick wins by focusing on immediate, high-impact improvements that will significantly accelerate progress and reduce risk. Leverage your judgment to prioritize practical solutions that deliver tangible value efficiently and rapidly.
• Exemplify constant learning and be obsessed with honing your craft as a security engineer by researching new technologies, performing threat hunts, and presenting your ideas with team members. Provide timely and actionable summaries of your work via written updates and demonstrations.
• Advocate for a culture of security at Shopify by staying ahead of others on latest changes in the threat landscape impacting Shopify and our merchants. Know all the important details about Shopify’s security systems so you can be ready to support other teams.
• Uplevel team capability through pairing sessions, code reviews, knowledge sharing, attracting and assessing new talent and onboarding of team members. Any area of our security tech stack that you touch, is left in a better position.

You might be great in this role if you have:

• Advanced the security posture of a complex, large-scale, cloud-based platform.
• Demonstrated a deep understanding of security, cloud platforms and container orchestration.
• Built, operated, and validated infrastructure security controls related to Kubernetes, networking, runtime environments, authentication/authorization, and service identity.
• Worked seamlessly with engineering teams across the organization to collaborate on technical projects and influence direction in favor of security.
• Delivered results quickly and iteratively in a fast-paced environment.
• Developed or contributed to large codebases written in Ruby, Go, and Python.
• Participated in an on-call rotation.
• Reviewed application security vulnerabilities with a focus on how they affect other systems and infrastructure.