Qorsa is a Canadian post-quantum cryptography and cybersecurity company building CasQade — a crypto-agile security platform protecting sovereign government, defence, financial, and critical-infrastructure networks against current and emerging cryptographic threats. We are headquartered in Waterloo, Ontario, with a European subsidiary in The Hague, Netherlands. Our work spans post-quantum cryptography, explainable AI, AI-driven threat intelligence, cryptographic agility, hardware security, and distributed systems, with active engagements across Canadian defence, NATO, and allied partner organizations. We are hiring a Senior Security Engineer to own the security and cryptographic trust behind SiQcure, our post-quantum platform for software supply chain integrity. SiQcure helps teams prove what is inside every software release, which cryptography it relies on, and whether it is ready for the quantum era, with results that anyone can verify. Regulations such as the EU Cyber Resilience Act, with full requirements applying from 11 December 2027, expect companies that sell software in the EU to know exactly what is inside it. At the same time, quantum computers are expected to break much of the encryption software relies on today, likely as early as 2028–2029. SiQcure’s results are only worth something if anyone can verify them, and that rests on the cryptography you would own. Customers rely on our results being signed, verifiable and resistant to future quantum attacks, and on the platform itself meeting regulatory obligations such as the EU Cyber Resilience Act.



We need an engineer who treats this as production software facing real adversaries, and who ships improvements as readily as they find problems. Ship our post-quantum cryptography work and the tooling that lets customers verify results independently. Own SiQcure’s own security posture, including SOC 2 and ISO 27001 readiness, security questionnaires from customers, and the evidence behind them. Work with product and compliance on features that support customers’ regulatory obligations. Threat-model current features, review security-sensitive changes across the team, and handle vulnerability reports and coordinated disclosure. Talk with customers’ security teams about how verification works and what they need from it. The ability to explain digital signatures, chain validation and revocation in practical terms, and to spot where a design fails open. Solid backend engineering in Go or a comparable language. You ship features as well as findings. Secure-by-default instincts backed by examples: a pipeline you hardened, an incident you handled, a CVE you coordinated. The ability to explain security to non-security engineers openly, weighing risk against shipping honestly. Strong Assets Supply-chain security ecosystem work: sigstore, in-toto, SLSA, TUF, SBOM tooling, or OpenSSF involvement. Regulatory or compliance-adjacent engineering (CRA, NIS2, SOC 2, FedRAMP). If you’ve contributed to sigstore, TUF, in-toto or similar projects, or run PKI or signing infrastructure in production, we’d especially like to hear from you. We compensate well — a strong base salary plus potential for bonuses. Dental care On-site parking

📌 Senior Security Engineer (Canada)
🏢 Qorsa
📍 Canada