Security Compliance Engineer

Shopify

The role's core focus is on building and managing Shopify's compliance programs for our advanced IT systems, it offers a unique opportunity to work in a flexible compliance environment where expertise, innovation, and unconventional approaches are highly valued.

In this role, you have the autonomy to discover, analyse, and solve security and compliance problems at scale. Resourcefulness is key - you’ll need to be able to quickly gather context on infrastructure, systems, software, and safeguards to help Shopify continue shipping and scaling while staying secure, trustworthy, and usable.

A ‘day in the life’ of this role may include any, or all, of the following:

Writing and updating code that automates and supports audit and compliance programs.

Meeting with SMEs from Production Engineering, Security Engineering, Product, Legal, and other areas to learn how Shopify works and ensure that the compliance programs accurately reflect what we do and how we do it.

Engaging with external auditors to design and perform audits for PCI programs.

Providing expert advice to Shopify teams with regard to security and compliance domains you manage

We want a dynamic technical expert capable of managing projects, solving complex problems, simplifying solutions, and inspiring and up-skilling the team.

This role is ideal for you if you are someone who enjoys being hands-on and building technical things to support your work. You must also be able to organize others as you build and manage complex security compliance programs for a fast paced engineering focused environment.

Qualifications

• Proven experience performing assurance and advisory roles relating to Information Technology with particular emphasis on system implementations, technical security configurations, and cloud native environments

• Hands-on experience building data analytics, reporting solutions and task automation tooling

• Experience evaluating IT, security and application controls in the context of a compliance program for a company of similar size and complexity of Shopify

• Strong knowledge of industry risk and PCI compliance framework

• Excellent analytical and problem-solving skills, with the ability to think strategically and identify innovative solutions to complex challenges

• Strong project management skills, with the ability to prioritize and manage multiple initiatives simultaneously using agile project management methodologies

• Exceptional communication and interpersonal skills, with the ability to effectively collaborate with stakeholders

• Self-motivated and adaptable, with a strong drive for continuous learning and professional growth

Responsibilities

• Be a security expert responsible for owning and building compliance activities for standards such as: SOC, PCI, SOX and others with a focus on PCI

• Dive deep into new products or initiatives to surface and analyse the impact on security compliance engineering

• Leverage data and visualization tools to identify areas for improvement, track progress and inform trusted decisions

• Be a strong and credible influencer among cross functional engineering and business teams

• Actively seek out opportunities to develop and deploy automations that will increase team efficiency

• Anticipate changes in our trust and security posture as the technical footprint and company operations change, and help propose solutions to adapt to change

• Develop safeguards, systems and policies that meet compliance requirements while balancing the need to move fast and stay innovative

• Shopifyhttps://www.shopify.com

• About the discipline

• Engineering. It’s our DNA.

• Engineering isn't a department at Shopify. It's our DNA. The engineers who thrive here care about the code, the system, and the merchants relying on both. They want hard problems and uncomfortable growth. They find solutions without waiting for permission. They ship weekly. They want commerce to work better for everyone. So does our founder, Tobi, who still codes and still shapes where this thing is going.

• They're open source nerds. They pair program because two brains write better code than one. New tools, new models, new approaches. They experiment constantly. Most of what's standard here started as someone hacking on something.

• They use AI like a keyboard, reflexively and everywhere, to clear the mundane and make room for thinking. And they work in the open. The fastest way to learn here is to watch someone better than you do the work. If that sounds like you, come build with us.

• Infrastructure engineering

• Infrastructure Engineers at Shopify build and maintain the systems that handle millions of requests per second and billions of dollars in transactions. At that scale, performance gains matter and weak assumptions surface quickly. Your systems power the experience for millions of entrepreneurs and buyers every minute of every day, including peak events like Black Friday.

• Engineers at Shopify spend the majority of their time actually writing code to build and improve infrastructure. You’ll solve problems that don’t exist anywhere else, with challenges that push what’s possible. If that lights you up, come build with us.

• Growth and rewards

• Mastery-matched compensation.

• Explore rewards

• ~Mastery

• At Shopify, getting better at your craft and increasing your impact is how you grow. Twice a year, we assess both in our ~Mastery cycle, Shopify’s performance review. Achieving higher ~Mastery is a promotion, and when you earn a promotion your total rewards grow with it. Crafter and manager are equal paths, so you can pursue excellence in the craft you’re best at.

• Total Rewards

• With Flex Comp, your Rewards Wallet gives you agency over your compensation mix. Adjust your mix of cash, restricted share units, and stock options (including programs like Long-Term Equity)* to where it makes sense for you, and mix it up anytime as life and priorities change. Buying a house? Want more skin in the game? Just experimenting? It’s your call.

• Flex Comp program offerings vary based on location, role, and employment type. Full details are set out in our Terms & Conditions and related plan documents.

• Built for real life

• Room for the rest of your life.

• Flexible work, remote by design

• A flexible vacation policy means most Shopifolk can take the vacation days they feel they need to recharge.

• If a change of everyday scenery is more your jam, Destination 90 means you can work from (almost) anywhere in the world for 90 days of the year.

• Your setup

• Your battlestation is your home base. Request the desk, chair, and AV gear you need to get shit done.

Benefits

• You need ‘em, we’ve got ‘em. Our health and welfare benefits may include health, dental, vision, disability, and life insurance depending on your country. If you’re in a country without a package, you'll receive a monthly allowance. We also offer mental health support for you and your dependents, including immediate and confidential services like counseling and coaching sessions.

• Family support

• We offer fertility benefits globally, along with paid parental leave to welcome a new family member.

• Applying to work here

• Show us your craft.

• Read the candidate guide

• 1Life Story

• The Life Story is how we understand the themes of your career journey so far, human to human. What you’ve learned, and how you made a difference. Show us the trophies and the bruises: the problems you’ve solved, the challenges you encountered, the decisions you made, and the lessons you learned along the way.

• 2Craft assessment

• We’re looking for world-class crafters. Crafters obsessed with pursuing excellence in their field. Our craft assessment looks at your personal journey toward mastery, and your potential to go broader and deeper in novel ways.

• 3Craft interviews

• Building on your craft assessment, these interviews dive deeper into your experience and technical aptitude. Depending on the role, this may include technical deep dives focusing on projects you've previously worked on, collaborating in a design critique, exploring a dataset using SQL, or taking the lead on solving a problem with your interviewer as your co-pilot.

• Pssst. Extraordinary technical work speaks for itself.

• Skip the resume. Show us what you’ve built instead.

• Take the /alt path