2 months ago
Canada (city not specified)Senior
Base Salary
$180k - $385k/yr
Responsibilities
- Lead architecture, code, and security-sensitive change reviews and identify recurring vulnerability patterns.
- Evaluate security risks in AI-powered products, including prompt injection, unsafe tool use, excessive agency, data exposure, tenant isolation, and sandbox escapes.
- Threat model new capabilities by identifying trust boundaries, abuse cases, and high-impact failure modes.
- Perform hands-on vulnerability testing, develop proofs of concept, assess exploitability, and partner with engineers on remediation.
- Build secure defaults, approved patterns, reusable controls, review requirements, and automated security checks.
- Pair with engineers, document practical security guidance, and strengthen product teams’ security capabilities.
- Communicate technical findings, business impact, and remediation options to engineers, product leaders, and executives.
Requirements
- Strong software engineering fundamentals and the ability to understand, test, and contribute fixes to production codebases independently.
- Proficiency in at least one of Python, Go, or TypeScript.
- Experience leading security reviews or threat models for complex production systems with measurable design or risk improvements.
- Knowledge of vulnerability classes including injection, authorization flaws, IDOR, SSRF, unsafe deserialization, race conditions, cryptographic misuse, and software supply-chain risks.
- Understanding of web applications, APIs, OAuth/OIDC, cloud platforms, containers, Kubernetes, and CI/CD systems.
- Ability to reason about untrusted input, authorization, isolation, identity, delegation, and data boundaries.
- Experience driving security improvements across multiple engineering teams through influence.
- Clear communication with technical and non-technical audiences.
- Preferred experience with SAST, DAST, SCA, custom linters, policy-as-code, multi-tenant SaaS, enterprise software, sensitive customer data, penetration testing, red teaming, security research, vulnerability disclosure, bug bounty programs, open-source security projects, published research, conference talks, or credited vulnerability discoveries.
Benefits
- Weekly lunch stipend of $75/£75 or equivalent in local currency.
- Full health and dental benefits, including a separate mental health budget.
- RRSP matching, 401K, and pension scheme.
- 100% parental leave top-up for up to six months for either parent.
- Annual enrichment benefits covering arts and culture, fitness and wellness, quality time, workspace improvements, education, conferences, courses, and coaching.
- Six weeks of paid vacation, equivalent to 30 working days.
- Travel budget for remote employees to visit other offices and an annual company offsite.
- Remote-friendly work arrangement with offices in Toronto, London, New York City, San Francisco, Montreal, Paris, Berlin, and Seoul.
- Daily lunch program, snacks, and community events for office employees.
- Co-working benefit for employees not near an office.
- $500 home office stipend.
Tech Stack
Categories
About Cohere
Cohere builds large language models and an enterprise AI platform that companies use for search, summarization, and workflow automation, delivered via API or private deployments. Founded in 2019 and headquartered in Toronto, it focuses on multilingual models, data controls, and options to run across major clouds or on-premises. The business is privately held and serves security- and compliance-sensitive organizations.