Senior Security Engineer

Tigera•Vancouver, BC

9d•CA$130,000 - CA$150,000•Hybrid

About The Position

Tigera is hiring a Senior Security Engineer to own product and cloud security across our product suite. You will lead threat models and security design reviews of new features, partner with engineering to harden our products and SaaS infrastructure, drive vulnerability and CVE management end-to-end, and contribute to detection engineering and the Security Incident Response Team (SIRT). The role spans application security and cloud security, ensuring Tigera's portfolio meets enterprise and regulated-industry compliance requirements while building secure-by-default patterns and self-service guardrails that scale security through automation and developer enablement. We are looking for a pragmatic security minded engineer who is as comfortable shipping security software and tooling as they are leading a threat model, and who scales security by empowering engineering teams rather than becoming a bottleneck.

Requirements

5+ years of hands-on security engineering experience across product and/or cloud security
Practical experience driving vulnerability management end-to-end — discovery, triage, exploitability assessment, proof-of-concept and fix development, and CVE coordination
Experience with threat modeling and security design reviews across the software development lifecycle
Experience conducting internal security testing or penetration testing of web applications, APIs, and cloud infrastructure using industry-standard tools (e.g. Burpsuite)
A drive to scale security through automation, tooling, and developer enablement in a highly collaborative environment
Familiarity of Kubernetes, containers, and cloud security across one or more major providers (GCP, Azure, AWS)
Strong written and verbal communication skills, including authoring threat models, security advisories, and customer-facing security artifacts
Coding ability in Python, Go or similar

Nice To Haves

Experience with software supply-chain security, securing host, database, and application solutions in microservices or cloud architecture
Experience with penetration testing (purple teaming) infrastructure and web applications
Experience with detection engineering experience with security platforms
Contributions to open-source security projects, bug bounty programs, public CVE disclosures, or security research publications
Industry certifications such as OSCP, OSWE, CISSP, GIAC, or equivalent

Responsibilities

Lead vulnerability management end-to-end across the Calico portfolio — internal security testing, triage, development of proofs-of-concept and fixes, issuing CVEs, and remediation in partnership with engineering — leveraging AI-assisted tooling to scale outcomes.
Conduct threat modeling and security design reviews across Calico Open Source, Calico Enterprise, and Calico Cloud, and drive product hardening and cloud-infrastructure security work to meet enterprise and regulated-industry expectations.
Ensure code security across the Calico product portfolio through secure code review, static analysis (SAST) and dependency scanning, and secure coding guidance for engineering teams.
Build and develop internal security tooling, write proofs-of-concept, contribute to patches, and dig into product code to validate findings and drive security remediation alongside engineering.
Contribute to detection engineering across our cloud footprint and our corporate environment, and participate in the Security Incident Response Team (SIRT) supporting investigations and post-incident reviews.
Drive adoption of secure-by-default patterns, paved-road tooling, and AI-assisted security automation across Tigera that scale security through developer enablement.