Senior Security Engineer

At Roofr, we're obsessed with our customers. We constantly gather feedback to shape, prioritize, and launch the products they truly need. That's what makes Roofr's CRM special. We started by building essential sales tools like aerial roof measurements and digital sales proposals. But when our customers asked for a simple, affordable way to manage and scale their entire businesses, we listened. So, we created a CRM that connects these solutions—along with payments, material ordering, and more—into a seamless, powerful platform. With a clear roadmap ahead, we're excited to continue expanding and leading the market with innovative products.We have an amazing culture, strong financials, and best-in-class company metrics. It's an exciting time to be part of an extraordinary startup that is already successful, yet still early enough to offer its team significant growth, equity, and the opportunity to make a real impact.This position is for an existing vacancy.As Senior Security Engineer, you'll report to the VP of Engineering and work closely with the CTO and DevOps as part of Roofr's security guild. You'll contribute directly to improving Roofr's security posture — sharpening what's already in place and driving it forward as the company scales. You'll own the tools and processes that detect and stop threats, partner with engineering on secure-by-design practices, and act as the front-line responder when something goes wrong.What You'll Get to DoOwn design and hardening of security infrastructure across cloud environments — network segmentation, firewalls, IDS/IPS, VPNs, WAF, and endpoint detection and response (EDR)Lead vulnerability management end to end: run assessments and authenticated scans, triage and prioritize by exploitability and blast radius, and drive remediation SLAs with engineeringBuild and tune detection content (SIEM/SOAR rules, alerting logic) against real attack techniques — not just default vendor signaturesAct as incident commander for security incidents: contain, eradicate, run forensics, and write the post-incident reviewThreat-model new features and infrastructure changes before they ship — catch design-level risk, not just implementation bugsOwn IAM hygiene and cloud security posture (least privilege, key/secret management, network boundaries) across production AWS accountsWrite, enforce, and maintain security policies and standards — own them as living controls, not documents that sit in a driveOwn Roofr's compliance program end to end: map controls to NIST CSF 2.0, SOC 2, and CCPA/CPRA, run the audits, close the gaps, and keep evidence current between themRun tabletop exercises and incident playbook drillsPush secure-by-design practices into engineering workflows — threat modeling in design review, security requirements in the SDLC, not a gate bolted on at the endQualificationsBachelor's degree in computer science, IT, cybersecurity, or equivalent hands-on experience5-8+ years in security engineering, incident response, or related infrastructure roles, including time as the primary or senior responder on real incidentsCertifications are a strong plus — CISSP, OSCP, GCIH, or CEHTechnicalDeep network security fundamentals — firewalls, VPNs, routing/segmentation, network boundaries, TLS, DNS, and how attackers actually abuse themHands-on cloud security in AWS — IAM policy design, VPC architecture, KMS/secrets management, CloudTrail/GuardDuty or equivalentReal incident response experience — triage, containment, forensics, root cause, not just theory from a courseWorking knowledge of SIEM/SOAR tooling, writing detection logic (Python/Bash), and building your own tooling when nothing off-the-shelf fitsFluent in compliance frameworks — NIST CSF 2.0, SOC 2, and CCPA/CPRA — and translating controls into policy people actually followStrong software engineer at heart — comfortable reading and writing real application code, not just scripts, so you can dig into the codebase directly instead of filing a ticket and waitingCompetenciesConfident being the only security voice in the room — makes the call and owns itTranslates technical risk into business terms leadership can actually act onCalm and decisive under incident pressure; documents as they go, not afterOwnership-oriented; builds the process that doesn't exist yet instead of waiting for oneStrong individual contributor who wants to stay hands-on — this role builds the foundation directly, it doesn't lead from the sideBonus Points:Experience using AI/LLM tooling for threat intelligence — alert triage, detection summarization, or hunting workflows — not required, but a plus for a team building modern security practice from scratchFamiliarity with GDPR — a plus as Roofr's customer base grows internationallyExperience with PHP/Laravel — a plus for digging into Roofr's own codebase directly, not requiredComfortable around Postgres — helpful, not requiredOur compensation ranges are built using multiple market benchmarks and reflect both the scope of the role and current market data. While many hires fall within the beginning to midpoint of the band to allow for growth over time, we tailor offers based on each candidate's experience, seniority, and demonstrated impact.What we offer (US + Canada)When you join our team, you're not just accepting a job. You're making a career move. Here's how we'll support you in doing some of the most impactful work of your career:Vacation/Paid Time Off:1st week of employment is mandatory PTO! Start your journey with Roofr by decompressing and recharging - we will see you in week 2!1 Friday off per month (we call those our laundry days!)Company wide paid shutdown for the week between Christmas and New YearsFlexible time off80% employer-paid benefits in the U.S. and 100% employer-paid premiums for Extended Healthcare and Dental in CanadaRRSP/401k matchGenerous Parental Leave policyPerks:We host an annual company retreat with great team building activitiesAmple learning and development opportunities to continue growing your careerHome office setup stipendInternet and phone allowanceRemote first cultureWeekly Friday paydays!AI NoticeAt Roofr, we're big fans of AI. It helps us write job descriptions that don't put you to sleep, takes notes during interviews so we can actually listen, and even helps us track down awesome humans like you.Feel free to use AI to prep, research, or get pumped up for your interview (we see you, ChatGPT power users ). But when it's time to chat, we'd love to meet you, not your AI alter ego. Bring your real, unfiltered self, we promise we will too.And don't worry, a real, live human is behind every part of our process. Every application is reviewed by a real person, and you'll always speak with real humans throughout the interview process. No bots, just good peopleRoofr is proud to be an equal opportunity employer. We are committed to equal employment opportunity in the workplace regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity or veteran status.J-18808-Ljbffr