Staff Security Engineer

Location: Remote within Ontario or Quebec Canada.

Reports to: Head of Information Security and Technology Operations

About us

Trolley is the payouts platform for the internet economy. Our mission is to unlock the global economic opportunity of the internet by building a truly borderless payouts ecosystem.

Through our platform and API, Trolley enables businesses to pay people anywhere in the world, supporting creators, on-demand workers, and suppliers at scale. Companies rely on Trolley as mission-critical infrastructure to automate payouts, collect tax and banking information, and reduce fraud and risk, all in one place.

Today, Trolley is the trusted payouts solution for hundreds of businesses, including Canva, SoundCloud, and Envato. We've processed millions of payments globally, helping creators, artists, and suppliers get paid quickly, securely, and with confidence.

As Trolley enters its next stage of growth, we're investing heavily in AI to accelerate product innovation, improve operational efficiency, and transform how software is built across the company.

The Opportunity

Trolley moves money for hundreds of businesses and the people they pay around the world. That puts security at the centre of everything we do, and the attackers every payments company faces are now using AI to move faster. We're looking for a Staff Security Engineer to help us stay ahead of them.

This is a hands-on role. Your first priority is finding and closing security gaps in our product and infrastructure, working side by side with engineering teams on threat modelling, design reviews and fixes. Over time, the bulk of your work shifts to building: security controls in our AWS platform, shared tooling and automation that makes the secure way the easy way, and evidence that proves our controls work with as little chasing as possible. The rest goes into incident response and compliance, and helping our engineering teams build securely from the start. You'll shape how security engineering works at Trolley, with the backing to hold a release when a serious security issue calls for it. It's an individual contributor role, with no direct reports today.

You'll set security engineering priorities with your manager and engineering leads, then lead the work through to completion. Engineering teams own planned remediation in their systems; you'll provide hands-on support, guidance and coaching, pair on implementation, and verify that fixes address the risk. When an emergency security fix is needed, you'll step in and implement it directly.

What You'll Do

Design security

Threat model new features and critical systems alongside our product engineering teams, early enough that what you find shapes the design.
Review security-sensitive code changes alongside engineers, focusing on authorization, access to customer data, and payment flows.
Set practical security standards for how we build, and turn them into defaults and tooling rather than checklists.
Help shape our identity and access management (IAM) architecture, including SSO and MFA, as it evolves.

Build controls into the platform

Build and maintain shared security tooling and CI/CD checks, including checks for exposed secrets and vulnerable dependencies.
Automate vulnerability management so issues are found, owned and fixed quickly.
Agree cloud security guardrails with our Infrastructure (SRE and DevOps) team, who run the platform, and work alongside them to make those guardrails the default in our AWS environment.

Defend against AI-enabled attackers

Shrink the time we stay exposed to a newly disclosed vulnerability, and detect quickly when an attacker gets there first.
Strengthen sign-in and account security, in our product and for our staff, against automated, AI-scaled account takeover attempts and bots, working with our product engineering teams.
Make AI-generated phishing and impersonation harder to pull off, through phishing-resistant sign-in and verified approval steps for high-risk requests, working with our IT team.