Opportunity is not evenly distributed. Shopify puts independence within reach for anyone with a dream to start a business. We propel entrepreneurs and enterprises to scale the heights of their potential. Since 2006, we’ve grown to over 8,300 employees and generated over $1 trillion in sales for millions of merchants in 175 countries.

This is life-defining work that directly impacts people’s lives as much as it transforms your own. This is putting the power of the few in the hands of the many, is a future with more voices rather than fewer, and is creating more choices instead of an elite option.

Moving at our pace brings a lot of change, complexity, and ambiguity—and a little bit of chaos. Shopifolk thrive on that and are comfortable being uncomfortable. That means Shopify is not the right place for everyone.

We’re looking for curious and detail-oriented individuals to join Shopify’s Third Party Security team as a Technical Security Analyst.

As a Technical Security Analyst, you’ll be leveraging your expertise in technology and security, along with your knowledge of Shopify’s products, applications and infrastructure, to understand and manage third-party vendor risk. You’ll use technology to build controls and operate them autonomously. You’ll work closely with many teams across Shopify to understand how new tools, technologies and services can help Shopifolk get shit done while keeping security top of mind.

The role will provide an opportunity to:

• architect and build technical controls which leverage automation to reduce toil.

• monitor Shopify’s current technology stack and implement technical changes to reduce security risk.

• collaborate with cross functional teams and gather evidence for assessments, implementations, and use of new tools and workflows.

• evaluate and determine the security risk of using third-party services at Shopify.

• lead and contribute to projects that build out and harden security at Shopify.

• utilize data and key metrics to understand Shopify’s security program.

• develop and share security best practices.

Qualifications

It would be great if you had experience in one or more of the following (don’t stress, we are not expecting experience in all of the following!):

• experience autonomously building and maintaining controls and security safeguards for frameworks.

• experience using automation to simplify security and IT practices.

• an understanding of cloud technologies, containerized environments and infrastructure as code.

• an understanding of information security fundamentals, privacy and compliance standards.

• ability to create and maintain trusted relationships.

• excellent communication skills, including technical breakdowns.

• passion for documenting strategy and approach.

• familiarity with one or more of the following tools:

  • Google, Okta, Jamf, Slack, Freshworks, macOS, and GitHub.