Senior Security Engineer - Platform Security
HybridSydney, New South Wales, Australia
Job Summary
Identify, introduce, and improve security controls across Canva's compute, platform engineering, and cloud infrastructure disciplines. Advise infrastructure engineers on cloud platform security best practices and design patterns, while leading threat modelling code review exercises for new and complex architectures. Design and develop tools, libraries, and services that support engineers in building secure software, and evaluate emerging security technologies to maintain platform and infrastructure security. Discover and triage vulnerabilities across the threat landscape, and assist in interviewing and hiring other security engineers. Mentor colleagues in areas of expertise while shaping how security engineering looks at Canva. This role resides within Application Security to secure the platform, using artefacts from threat modelling and investigative work to inform secure decisions.
Required Qualifications
- experience conducting infrastructure-focused security design reviews and assessments, including risk assessments and threat modelling
- partnered with engineering teams to identify, audit, and remediate security issues across the DevOps ecosystem, including continuous integration, continuous delivery, infrastructure as code, and orchestration platforms
- deep expertise in securing cloud environments such as AWS and Google Cloud, along with a strong understanding of infrastructure domains including observability and site reliability
- proficient in one or more modern programming languages, with experience in Go, Python, or Java
- successfully led security initiatives end-to-end, balancing the needs of multiple stakeholders while mentoring and supporting the growth of security engineers
- excellent communicator who can effectively engage with people from a wide range of backgrounds, technical disciplines, and experience levels
- This role is based in Sydney
- calls it home
Desired Qualifications
- experience building and deploying security tooling to support containerised workloads
- proficient with infrastructure and orchestration technologies such as Terraform, Docker, and Kubernetes, as well as CI/CD platforms including Buildkite, Jenkins, and ArgoCD, or equivalent technologies
- strong understanding of secrets management platforms and best-practice patterns for managing secrets in orchestrated environments
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.