Staff Security Engineer

Staff Security Engineer

This position is remote based in the US or Canada

Applicants outside of the US and Canada will not be considered for this role

Company Overview

Robots & Pencils is an applied AI engineering firm building the next frontier of business architecture. We design and ship AI co-workers that integrate into enterprise operations and deliver measurable results for our clients. We're all in on AWS, combining deep UX capability with senior engineering talent to get AI into production fast and keep it there. We’ve earned the trust of leaders across Consumer Products and Retail, Education, Energy, Financial Services, Healthcare, and Manufacturing and more, and earned a reputation as the nimble alternative to traditional global systems integrators. Founded in 2009, with delivery centers in Canada, the United States, Eastern Europe, and Latin America, we are smaller, faster, and more senior by design. Our teams average 15+ years of experience. We move fast, sweat the details, and build things that actually ship.

Position Overview

We're hiring Staff Security Engineer to lead the security of the cloud platforms and systems we build and ship for clients, and to deploy across a range of client engagements. This role is ideal for an experienced engineer who can define security architecture and standards, own the hardest security problems end-to-end, and provide technical leadership across teams.

In this role, you will work as a key technical leader on a cross-functional team, defining security architecture across cloud infrastructure (AWS, GCP, and Kubernetes). You'll lead security reviews, write production Python and Terraform, turn compliance obligations into automated evidence, mentor more junior engineers, and partner closely with engineering and leadership to ensure the systems we ship are secure, reliable, and built to last.

Why This Role Matters

At Robots & Pencils, we design AI systems for a human world. Our name says it all. Robots and pencils means engineering paired with creativity, because every agent we ship has to work for real people in real workflows. That balance is baked into how we operate. Every role here contributes directly to that mission. Here, you shape how AI systems integrate into enterprise operations, how teams move at real velocity, and how products create measurable impact for clients and the people they serve. We ship production-ready AI in 30 to 45 days. That pace demands people who take ownership, lead with craft, and care deeply about what they put their name on.

What You’ll Do

You'll do hands-on security engineering across the areas below, listed in priority order.

Craft & Delivery

Required

• Production Python and software development: comfortable writing production Python against cloud provider SDKs, not just scripting. You will build configuration baselines, provisioning workflows, scheduled jobs, log pipelines, CLI tooling, and evidence automation.
• Operational security and reliability: on-call and incident response, SLIs/SLOs, cloud account lifecycle (automated provisioning, decommissioning, and inventory, with safe rollout), configuration baselines, identity federation and least privilege, and audit pipelines.
• Cloud security architecture: design controls across identity, network, and data layers, including secrets management and encryption. Bring deep AWS IAM expertise: cross-account trust, permission boundaries, IAM Identity Center or an equivalent federation model, policy evaluation, and Organizations with service control policies. IAM experience that stops at attaching managed policies is not sufficient.
• GCP: hands-on experience is required, including IAM, organization policy, deny policies, audit logging, and GKE.
• Working knowledge of Kubernetes security: RBAC, admission control, Helm, and workload identity federation into cloud IAM, applied in real-world environments.
• Terraform: module design, state management, drift, and reviewing other teams' plans.
• Security automation in CI/CD: embed security automation and policy-as-code into pipelines, driving shift-left detection across teams.
• Compliance and audit evidence: own control implementation for SOC 2, ISO 27001, PCI, or equivalent frameworks, and automate evidence collection wherever possible. Willingness to do audit evidence work is mandatory.
• SQL for investigation and evidence: Athena, BigQuery, Presto, Snowflake, or equivalent. You will query your way to most answers.

Preferred

• Using AI within security workflows: LLM APIs, tool and function calling, and multi-step agent flows for detection and triage.
• Detection engineering and logging at scale.
• Observability tooling: metrics pipelines and alert design, with Prometheus, Grafana, or OpenTelemetry.
• Experience working in multi-vendor environments.

Nice to have

• Policy-as-code tooling (Open Policy Agent/Rego, Kyverno, Cloud Custodian).
• Cloud security posture management tooling (Wiz, Prisma Cloud, Orca, Prowler).
• SIEM tooling.
• PKI and certificate lifecycle.
• Azure.
• Cilium, eBPF, Envoy, and the Kubernetes Gateway API.
• Go or Rust.
• Distributed job scheduling.

Collaboration & Communication

• Partner with product, engineering, and leadership to shape security strategy and align technical direction with business outcomes
• Translate complex security tradeoffs, risks, and opportunities into clear narratives that drive decision-making across technical and non-technical stakeholders
• Lead security reviews and technical discussions, raising the bar for engineering rigor and constructive challenge across the team
• Engage closely with engineering, data, and client teams to align security work with broader business priorities and measurable outcomes

Leadership & Influence

• Define security architecture and engineering standards, bringing depth on tradeoffs, long-term implications, and responsible AI practices
• Mentor and grow junior and mid-level engineers, multiplying impact through coaching, code reviews, and pairing on hard problems
• Take ownership of the most ambiguous and highest-stakes pieces of work, driving them through to production with care for reliability, cost, and safety

What You’ll Bring

• 7+ years of professional security or software engineering experience, with at least 3 years leading application and cloud security initiatives.
• 4+ years in cloud platform engineering, cloud security engineering, or infrastructure production engineering.
• Demonstrated leadership and technical mentoring experience across a team or organization.
• Strong stakeholder communication skills across technical and non-technical audiences.
• Demonstrable, day-to-day usage and expert knowledge of AI-forward tools such as Claude and Cursor.
• Excellent problem-solving skills and sound judgment when requirements and risks are unclear.

You’ll Do Well Here if You Are

• A doer. You see something broken and fix it. You'd rather move on clarity than wait for certainty.
• A fast learner who knows you don't know everything. The AI landscape changes weekly. You're senior enough to know better and curious enough to keep learning anyway.
• Direct in a way that makes the work better. You give honest feedback. You'd rather have the hard conversation than blow smoke.
• Obsessed with craft. You know genius is in the details. You ship exceptional, not perfect, and you don't put your name on work you wouldn't stand behind.
• Built for ownership. You honor commitments, admit mistakes fast, and back your teammates when a decision costs something. No handoffs, no finger-pointing.
• All in. You treat clients' businesses like your own. You take the work seriously without taking yourself seriously.
• Resourceful when the budget, timeline, or team is tight. Constraints don't slow you down. They sharpen you.
• Glad to be in the room with people who care as much as you do. Our teams average fifteen-plus years of experience. We hire people who push each other to do better work. The below range reflects the range of possible compensation for this role at the time of this posting. We may ultimately pay more or less than the posted range. This range may be modified in the future. An employee's position within the salary range will be based on several factors including, but not limited to, relevant education, qualifications, certifications, experience, skills, seniority, geographic location, performance, shift, travel requirements, sales or revenue-based metrics, any collective bargaining agreements, and business or organizational needs. The salary range for this role based in the US is $116,000. - $161,000. USD. W e offer a comprehensive package of benefits including paid time off, medical/dental/vision insurance and 401(k) to eligible employees. An offer of employment may be conditional upon successful completion of a background check in accordance with local legislation and our candidate privacy notice. Your current employer will not be contacted without your permission. We are committed to ensuring equal employment opportunities for all job applicants and employees. Employment decisions are based upon job-related reasons regardless of an applicant's race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, marital status, genetic information, protected veteran status, or any other status protected by law.

Where you can be based

This position is 100% remote and open to applicants based in Canada and United States.