At Roofr, we’re obsessed with our customers. That’s what makes Roofr’s CRM special. We started by building essential sales tools like aerial roof measurements and digital sales proposals. But when our customers asked for a simple, affordable way to manage and scale their entire businesses, we listened. So, we created a CRM that connects these solutions—along with payments, material ordering, and more—into a seamless, powerful platform. It’s an exciting time to be part of an extraordinary startup that is already successful, yet still early enough to offer its team significant growth, equity, and the prospect to make a real impact.
If you find one of our emails in spam, please mark it as “Not Spam” to help ensure future messages reach your inbox.***
As Senior Security Engineer, you'll report to the VP of Engineering and work closely with the CTO and DevOps as part of Roofr's security guild. You'll contribute directly to improving Roofr's security posture — sharpening what's already in place and driving it forward as the company scales. Own design and hardening of security infrastructure across cloud environments — network segmentation, firewalls, IDS/IPS, VPNs, WAF, and endpoint detection and response (EDR)
Build and tune detection content (SIEM/SOAR rules, alerting logic) against real attack techniques — not just default vendor signatures
Act as incident commander for security incidents: contain, eradicate, run forensics, and write the post-incident review
Threat-model new features and infrastructure changes before they ship — catch design-level risk, not just implementation bugs
Own IAM hygiene and cloud security posture (least privilege, key/secret management, network boundaries) across production AWS accounts
Write, enforce, and maintain security policies and standards — own them as living controls, not documents that sit in a drive




Push secure-by-design practices into engineering workflows — threat modeling in design review, security requirements in the SDLC, not a gate bolted on at the end
Bachelor's degree in computer science, IT, cybersecurity, or equivalent hands-on experience

- 5-8+ years in security engineering, incident response, or related infrastructure roles, including time as the primary or senior responder on real incidents
- Technical

Deep network security fundamentals — firewalls, VPNs, routing/segmentation, network boundaries, TLS, DNS, and how attackers actually abuse them
Hands-on cloud security in AWS — IAM policy design, VPC architecture, KMS/secrets management, CloudTrail/GuardDuty or equivalent
Working knowledge of SIEM/SOAR tooling, writing detection logic (Python/Bash), and building your own tooling when nothing off-the-shelf fits
Fluent in compliance frameworks — NIST CSF 2.0, SOC 2, and CCPA/CPRA — and translating controls into policy people actually follow
Strong software engineer at heart — comfortable reading and writing real application code, not just scripts, so you can dig into the codebase directly instead of filing a ticket and waiting
Confident being the only security voice in the room — makes the call and owns it
Translates technical risk into business terms leadership can actually act on
Strong individual contributor who wants to stay hands-on — this role builds the foundation directly, it doesn't lead from the side
Bonus Points:

Experience using AI/LLM tooling for threat intelligence — alert triage,



detection summarization, or hunting workflows — not required, but a plus for a team building modern security practice from scratch
Familiarity with GDPR — a plus as Roofr's customer base grows internationally
Experience with PHP/Laravel — a plus for digging into Roofr's own codebase directly, not required
Our compensation ranges are built using multiple market benchmarks and reflect both the scope of the role and current market data. Vacation/Paid Time Off:

- Flexible time off
- S. and 100% employer-paid premiums for Extended Healthcare and Dental in Canada
- Generous Parental Leave policy

We host an annual company retreat with great team building activities
Ample learning and development opportunities to continue growing your career
Home office setup stipend
Internet and phone allowance
Remote first culture
AI Notice
At Roofr, we’re big fans of AI. It helps us write job descriptions that don’t put you to sleep, takes notes during interviews so we can actually listen, and even helps us track down awesome humans like you.
Feel free to use AI to prep, research, or get pumped up for your interview (we see you, ChatGPT power users ). But when it’s time to chat, we’d love to meet you, not your AI alter ego. Our company takes the security and privacy of job applicants very seriously. We will never ask for payment, bank details, or personal financial information as part of the application process. All our legitimate job postings can be found on our official career site. Your safety and security are important to us — thank you for your vigilance!
We are committed to equal employment opportunity in the workplace regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity or veteran status.

📌 Senior Security Engineer - Remote (Canada)
🏢 Roofr
📍 Canada