Security Engineer

PagerDuty is the global leader in AI-first digital operations, trusted by approximately two-thirds of the Fortune 100.

• Harden AWS and Kubernetes environments against CIS Benchmarks, DISA STIGs, and FedRAMP Moderate baselines
• Own Kubernetes and container security end to end: harden EKS clusters and Istio service mesh, design Kubernetes RBAC and least-privilege workload identity (IRSA/pod identity), drive container supply chain controls
• Build and operate security-focused platforms, services, and automation using Python/Go, Terraform, and Kubernetes policy-as-code
• Own PKI and encryption standards: certificate lifecycle, KMS-backed key management and rotation, TLS/mTLS, encryption-at-rest and in-transit
• Design and roll out Service Control Policy (SCP) guardrails and least-privilege IAM/PAM across dozens of accounts
• Build agentic AI solutions to streamline security work: posture triage, threat modeling, risk assessment, incident enrichment, compliance-evidence generation
• Shape detection strategy for Kubernetes/Istio and identity domains; author and tune detections in SIEM stack
• Participate in on-call rotation and act as Incident Commander during incidents
• Partner with AppSec and GRC teams

• Strong software engineering background with ability to design and ship security-focused platforms as a developer
• Proficiency in Python and/or Go and Infrastructure as Code (Terraform)
• 5+ years in security engineering with hands-on expertise securing Kubernetes and containerized environments: EKS, Kubernetes RBAC, admission control (OPA/Gatekeeper or Kyverno), network policy, workload identity, container runtime/image security, Istio
• Deep expertise with AWS security services and least-privilege IAM/PAM: IAM family, Organizations/SCPs, Secrets Manager, KMS, GuardDuty, CloudTrail, Config
• Ability to automate security controls as code and inform detection strategy in a modern SIEM (CrowdStrike NG-SIEM, Splunk)

• 2 days per week from Toronto, Ontario office