[All remote jobs](https://jobicy.com/jobs.md)[![Roofr logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/03/1a4a90db-221.jpg)](https://jobicy.com/company/roofr.md)[Roofr](https://jobicy.com/company/roofr.md) # Senior Security Engineer AI Summary Roofr is seeking a senior hands-on security engineer to strengthen cloud, application, and operational security for its CRM platform. The role owns security infrastructure, vulnerability management, detection engineering, incident response, IAM, and compliance activities across AWS production environments. This individual-contributor position will partner closely with engineering leadership and DevOps while acting as a primary security decision-maker and incident commander. The ideal candidate has 5–8+ years of relevant experience, practical AWS and network-security expertise, and the ability to embed secure-by-design practices into the SDLC. The role is remote for candidates in Canada.[Apply for this job](#job-application)[View company](https://jobicy.com/company/roofr.md)ShareRemote from[Canada](https://jobicy.com/job-region/canada.md)SalaryUndisclosedDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceDirectorPublished6 Nov 2026Apply before6 Dec 2026Listing views52Application actions1Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. Opportunity details ## About this role. At Roofr, we’re obsessed with our customers. We constantly gather feedback to shape, prioritize, and launch the products they truly need. That’s what makes Roofr’s CRM special. We started by building essential sales tools like aerial roof measurements and digital sales proposals. But when our customers asked for a simple, affordable way to manage and scale their entire businesses, we listened. So, we created a CRM that connects these solutions—along with payments, material ordering, and more—into a seamless, powerful platform. With a clear roadmap ahead, we’re excited to continue expanding and leading the market with innovative products. We have an amazing culture, strong financials, and best-in-class company metrics. It’s an exciting time to be part of an extraordinary startup that is already successful, yet still early enough to offer its team significant growth, equity, and the opportunity to make a real impact. This position is for an existing vacancy. ***A quick note: some of our emails may be filtered into your spam/junk folder. Please check there regularly for any communications from us, including interview scheduling, next steps, and updates on your application. If you find one of our emails in spam, please mark it as “Not Spam” to help ensure future messages reach your inbox.*** As Senior Security Engineer, you’ll report to the VP of Engineering and work closely with the CTO and DevOps as part of Roofr’s security guild. You’ll contribute directly to improving Roofr’s security posture — sharpening what’s already in place and driving it forward as the company scales. You’ll own the tools and processes that detect and stop threats, partner with engineering on secure-by-design practices, and act as the front-line responder when something goes wrong. ### What You’ll Get to Do * Own design and hardening of security infrastructure across cloud environments — network segmentation, firewalls, IDS/IPS, VPNs, WAF, and endpoint detection and response (EDR) * Lead vulnerability management end to end: run assessments and authenticated scans, triage and prioritize by exploitability and blast radius, and drive remediation SLAs with engineering * Build and tune detection content (SIEM/SOAR rules, alerting logic) against real attack techniques — not just default vendor signatures * Act as incident commander for security incidents: contain, eradicate, run forensics, and write the post-incident review * Threat-model new features and infrastructure changes before they ship — catch design-level risk, not just implementation bugs * Own IAM hygiene and cloud security posture (least privilege, key/secret management, network boundaries) across production AWS accounts * Write, enforce, and maintain security policies and standards — own them as living controls, not documents that sit in a drive * Own Roofr’s compliance program end to end: map controls to NIST CSF 2.0, SOC 2, and CCPA/CPRA, run the audits, close the gaps, and keep evidence current between them * Run tabletop exercises and incident playbook drills * Push secure-by-design practices into engineering workflows — threat modeling in design review, security requirements in the SDLC, not a gate bolted on at the end ### What You’ll Bring to the Role ### Qualifications * Bachelor’s degree in computer science, IT, cybersecurity, or equivalent hands-on experience * 5-8+ years in security engineering, incident response, or related infrastructure roles, including time as the primary or senior responder on real incidents * Certifications are a strong plus — CISSP, OSCP, GCIH, or CEH ### Technical * Deep network security fundamentals — firewalls, VPNs, routing/segmentation, network boundaries, TLS, DNS, and how attackers actually abuse them * Hands-on cloud security in AWS — IAM policy design, VPC architecture, KMS/secrets management, CloudTrail/GuardDuty or equivalent * Real incident response experience — triage, containment, forensics, root cause, not just theory from a course * Working knowledge of SIEM/SOAR tooling, writing detection logic (Python/Bash), and building your own tooling when nothing off-the-shelf fits * Fluent in compliance frameworks — NIST CSF 2.0, SOC 2, and CCPA/CPRA — and translating controls into policy people actually follow * Strong software engineer at heart — comfortable reading and writing real application code, not just scripts, so you can dig into the codebase directly instead of filing a ticket and waiting ### Competencies * Confident being the only security voice in the room — makes the call and owns it * Translates technical risk into business terms leadership can actually act on * Calm and decisive under incident pressure; documents as they go, not after * Ownership-oriented; builds the process that doesn’t exist yet instead of waiting for one * Strong individual contributor who wants to stay hands-on — this role builds the foundation directly, it doesn’t lead from the side ### Bonus Points: * Experience using AI/LLM tooling for threat intelligence — alert triage, detection summarization, or hunting workflows — not required, but a plus for a team building modern security practice from scratch * Familiarity with GDPR — a plus as Roofr’s customer base grows internationally * Experience with PHP/Laravel — a plus for digging into Roofr’s own codebase directly, not required * Comfortable around Postgres — helpful, not required Our compensation ranges are built using multiple market benchmarks and reflect both the scope of the role and current market data. While many hires fall within the beginning to midpoint of the band to allow for growth over time, we tailor offers based on each candidate’s experience, seniority, and demonstrated impact. 🏠 What we offer (US + Canada) When you join our team, you’re not just accepting a job. You’re making a career move. Here’s how we’ll support you in doing some of the most impactful work of your career: 🏝️ Vacation/Paid Time Off: * 1st week of employment is mandatory PTO! Start your journey with Roofr by decompressing and recharging – we will see you in week 2! * 1 Friday off per month (we call those our laundry days!) * Company wide paid shutdown for the week between Christmas and New Years * Flexible time off * 80% employer-paid benefits in the U.S. and 100% employer-paid premiums for Extended Healthcare and Dental in Canada * RRSP/401k match * Generous Parental Leave policy 🤝 Perks: * We host an annual company retreat with great team building activities * Ample learning and development opportunities to continue growing your career * Home office setup stipend * Internet and phone allowance * Remote first culture * Weekly Friday paydays! 🤖 AI Notice At Roofr, we’re big fans of AI. It helps us write job descriptions that don’t put you to sleep, takes notes during interviews so we can actually listen, and even helps us track down awesome humans like you. Feel free to use AI to prep, research, or get pumped up for your interview (we see you, ChatGPT power users 👀). But when it’s time to chat, we’d love to meet you, not your AI alter ego. Bring your real, unfiltered self, we promise we will too. And don’t worry, a real, live human is behind every part of our process. Every application is reviewed by a real person, and you’ll always speak with real humans throughout the interview process. No bots, just good people ☺️ ⚠️ Important Notice We’ve been made aware of an individual impersonating Roofr using a fraudulent domain: roofrr.com (note the extra “r”). Our company takes the security and privacy of job applicants very seriously. We will never ask for payment, bank details, or personal financial information as part of the application process. All our legitimate job postings can be found on our official career site. Please be cautious of job offers that come from non-company email addresses, instant messaging platforms, or unsolicited calls. To ensure your application is legitimate, please apply directly through our official careers page: [https://roofr.com/careers](https://roofr.com/careers). If you receive any suspicious messages or have questions, reach out to us at talent@roofr.com. Your safety and security are important to us — thank you for your vigilance! Roofr is proud to be an equal opportunity employer. We are committed to equal employment opportunity in the workplace regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity or veteran status. Show more [Apply now >](https://jobicy.com/jobs/159233-senior-security-engineer-2.md) > Annual salary information is not provided for this position. Explore salary ranges for similar roles in our [Salary Directory ›](https://jobicy.com/salaries.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 4/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 4/5IndependentCollaborative AI insightThis is a broad senior role with end-to-end ownership of security controls, incident response, cloud posture, and audit readiness. It requires strong technical judgment under pressure and the ability to establish processes where they may not yet exist. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$160,000US market range (per year)$135k–$190k0$209.00k AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. No employer base-pay range is disclosed. Estimated annual USD market compensation for a senior cloud security engineer with AWS, incident-response, detection-engineering, and compliance ownership is approximately $135,000–$190,000, with an estimated midpoint of $160,000; this is an AI estimate rather than employer-provided compensation. ## Core skills Skills and capabilities most closely associated with this opportunity. [AWS security](https://jobicy.com/jobs?search_keywords=AWS%20security.md)[Incident response](https://jobicy.com/jobs?search_keywords=Incident%20response.md)[Vulnerability management](https://jobicy.com/jobs?search_keywords=Vulnerability%20management.md)[SIEM](https://jobicy.com/jobs?search_keywords=SIEM.md)[SOAR](https://jobicy.com/jobs?search_keywords=SOAR.md)[Detection engineering](https://jobicy.com/jobs?search_keywords=Detection%20engineering.md)[Network security](https://jobicy.com/jobs?search_keywords=Network%20security.md)[IAM](https://jobicy.com/jobs?search_keywords=IAM.md)[Threat modeling](https://jobicy.com/jobs?search_keywords=Threat%20modeling.md)[SOC 2](https://jobicy.com/jobs?search_keywords=SOC%202.md)[NIST CSF](https://jobicy.com/jobs?search_keywords=NIST%20CSF.md)[CCPA/CPRA](https://jobicy.com/jobs?search_keywords=CCPACPRA.md)[Python](https://jobicy.com/jobs?search_keywords=Python.md)[Bash](https://jobicy.com/jobs?search_keywords=Bash.md)[CloudTrail and GuardDuty](https://jobicy.com/jobs?search_keywords=CloudTrail%20and%20GuardDuty.md) Sample interview questionsHow would you prioritize vulnerabilities discovered across Roofr's production AWS environment?I would combine technical severity with exploitability, internet exposure, asset criticality, identity permissions, and potential blast radius. I would define remediation SLAs by risk tier, validate compensating controls, and track ownership and exceptions through to closure. Describe how you would build detection content beyond default SIEM vendor rules. I would begin with a threat model and relevant attacker techniques, then map telemetry sources such as CloudTrail, identity logs, endpoint data, and application events. I would create detections around high-value behaviors, tune them using real environment baselines, and measure fidelity through incident reviews and tabletop exercises. What steps would you take as incident commander during a suspected cloud credential compromise? I would establish scope and severity, preserve evidence, revoke or rotate affected credentials, contain suspicious sessions and access paths, and review CloudTrail activity for persistence or lateral movement. I would coordinate technical and business stakeholders, document decisions in real time, eradicate the root cause, and lead a post-incident review with corrective actions. How do you embed threat modeling into an engineering workflow without making it a late-stage gate? I would introduce lightweight threat modeling during design reviews for meaningful changes, using reusable prompts and security requirements tied to common architecture patterns. The output should create clear, owned engineering actions and be supported by secure defaults, automated checks, and feedback from incidents and vulnerability findings. How would you prepare and maintain evidence for SOC 2 and NIST CSF controls? I would map technical and operational controls to framework requirements, define control owners and evidence sources, and automate recurring evidence collection where possible. I would maintain a control calendar, test operating effectiveness between audits, document exceptions, and use audit findings to improve the underlying security program rather than treating compliance as a one-time exercise. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Spotify logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210328105941-289246.jpg) Spotify Nov 6 New ### [Security Engineer – Product Security](https://jobicy.com/jobs/159248-security-engineer-product-security.md) The Platform team creates the technology that enables Spotify to learn quickly and scale easily, enabling rapid growth in our users and our business around the globe. Spanning many disciplines,… * ![Five9 logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/7c3d754e-221.png) Five9 Nov 6 New ### [Cloud Governance Engineer](https://jobicy.com/jobs/154675-cloud-governance-engineer.md) Join us in bringing joy to customer experience. Five9 is a leading provider of cloud contact center software, bringing the power of cloud innovation to customers worldwide. Living our values… * ![Abby Care logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/3d3ea8fe-221.jpeg) Abby Care Nov 6 New ### [Senior Security Analyst](https://jobicy.com/jobs/154692-senior-security-analyst.md) About Abby Care: Powering the future of care at home for all of America. Abby Care is building the leading AI-native platform for family-led care. America is facing a growing… * ![NetBox Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/df239a55-221.png) NetBox Labs Nov 5 New ### [Security Architect](https://jobicy.com/jobs/159190-security-architect.md) NetBox Labs builds NetBox, the open source network source of truth, and the cloud and enterprise products built on it. We’re hiring a hands-on Security Architect: a builder unleashed by… * ![Spotify logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210328105941-289246.jpg) Spotify Nov 5 New ### [Staff Engineer – Identity and Access Management User Platform](https://jobicy.com/jobs/159119-staff-engineer-identity-and-access-management-user-platform.md) The Platform mission creates the technology that enables Spotify to learn quickly and scale easily, enabling rapid growth in our users and our business around the globe. Spanning many disciplines,… * ![Keyfactor, Inc. logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/ba8ae349-221.png) Keyfactor, Inc. Nov 5 New ### [Senior Solutions Consultant](https://jobicy.com/jobs/159061-senior-solutions-consultant-3.md) About Keyfactor Our mission is to securely connect the world: humans, machines, and AI. Keyfactor is the leader in trust infrastructure for AI and machines, helping the world’s largest enterprises… * ![CertiK logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210308091023-955845.jpg) CertiK Nov 5 New ### [Blockchain Security Expert – AI Track](https://jobicy.com/jobs/152451-blockchain-security-expert-ai-track.md) About the Company CertiK is the largest blockchain security auditor and provides a comprehensive suite of tools to secure the industry at scale. To date, CertiK has worked with over… * ![CertiK logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210308091023-955845.jpg) CertiK Nov 5 New ### [Blockchain Security Engineer – Senior Level (Solidity / Rust / Golang )](https://jobicy.com/jobs/152447-blockchain-security-engineer-senior-level-solidity-rust-golang.md) About the Role: We are seeking a Senior Blockchain Security Engineer with a strong security mindset and deep technical expertise across smart contracts, blockchain nodes, and decentralized infrastructure. You will… * ![Brain Co. logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/b2bdd014-221.png) Brain Co. Nov 4 New ### [AI Application Security Engineer](https://jobicy.com/jobs/158889-ai-application-security-engineer.md) Our Mission Rebuild how the world works, to make institutions work better for the people they serve. About Brain Co. Brain Co. builds AI-native operating systems for large, regulated institutions…. * ![Liftoff logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/c47aea9f-221.png) Liftoff Nov 3 ### [Application Security Engineer, Generative AI](https://jobicy.com/jobs/158817-application-security-engineer-generative-ai.md) Liftoff is a leading AI-powered performance marketing platform for the mobile app economy. Our end-to-end technology stack helps app marketers acquire and retain high-value users, while enabling publishers to maximize… [Browse all jobs](https://jobicy.com/jobs.md)