SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Gorgias is building a unified AI agent platform for conversational commerce—enabling brands to sell, support, and re-engage customers through intelligent chat. As a Senior Security Engineer, you will own critical security infrastructure and incident response for a high-growth SaaS platform serving enterprise customers globally.
You will drive platform and cloud security across 10+ GKE clusters, designing secure-by-default architectures with policy-as-code (OPA/Kyverno) that enforce guardrails without friction. You'll harden CI/CD pipelines (GitHub Actions, ArgoCD, Terraform), implement decoupled secrets management, and strengthen networking fundamentals including VPC design and zero-trust segmentation.
On the detection and response side, you'll build security-focused observability that catches real threats, implement runtime detection (IDS, file integrity monitoring, behavioral anomaly detection), develop and own incident response playbooks, and manage/evolve the SIEM for signal-to-noise improvements.
You'll also design and enforce strong authentication standards (OAuth 2.0, OIDC, SAML) across internal tools and customer-facing APIs, audit privileged access management, and own SOC 2 Type II compliance health while driving toward ISO 27001 and GDPR/PII data protection as the company expands globally.
The role requires 5+ years in infrastructure or cloud security (ideally in high-growth SaaS), deep GCP and Kubernetes expertise, strong networking fundamentals, hands-on CI/CD and IaC hardening experience, auth expertise, policy-as-code proficiency, detection/response background, compliance experience (SOC 2 Type II, ISO 27001, GDPR), and scripting fluency in Python, Go, or Bash.
You'll work closely with an experienced SRE team maintaining multi-TB Postgres clusters, RabbitMQ/Redis at scale, 10+ global GKE clusters serving 15k+ tenants, Kafka/Debezium/Apache Flink, and best practices around Kubernetes, SLIs/SLOs, incident management, observability, and disaster recovery.
