Senior Security Engineer

About Qorsa

Qorsa is a Canadian post-quantum cryptography and cybersecurity company building CasQade — a crypto-agile security platform protecting sovereign government, defence, financial, and critical-infrastructure networks against current and emerging cryptographic threats. We are headquartered in Waterloo, Ontario, with a European subsidiary in The Hague, Netherlands. Our work spans post-quantum cryptography, explainable AI, AI-driven threat intelligence, cryptographic agility, hardware security, and distributed systems, with active engagements across Canadian defence, NATO, and allied partner organizations.

The Role

We are hiring a Senior Security Engineer to own the security and cryptographic trust behind SiQcure, our post-quantum platform for software supply chain integrity. SiQcure helps teams prove what is inside every software release, which cryptography it relies on, and whether it is ready for the quantum era, with results that anyone can verify.

Regulations such as the EU Cyber Resilience Act, with full requirements applying from 11 December 2027, expect companies that sell software in the EU to know exactly what is inside it. At the same time, quantum computers are expected to break much of the encryption software relies on today, likely as early as 2028–2029. SiQcure’s results are only worth something if anyone can verify them, and that rests on the cryptography you would own.

Cryptographic trust is at the heart of SiQcure. Customers rely on our results being signed, verifiable and resistant to future quantum attacks, and on the platform itself meeting regulatory obligations such as the EU Cyber Resilience Act. We need an engineer who treats this as production software facing real adversaries, and who ships improvements as readily as they find problems.

Responsibilities

• Own the signing and verification systems that underpin the platform, including key management and trust
• Ship our post-quantum cryptography work and the tooling that lets customers verify results independently
• Extend identity and access controls across the platform
• Own SiQcure’s own security posture, including SOC 2 and ISO 27001 readiness, security questionnaires from customers, and the evidence behind them
• Work with product and compliance on features that support customers’ regulatory obligations
• Threat-model new features, review security-sensitive changes across the team, and handle vulnerability reports and coordinated disclosure
• Write tests, including negative tests that prove a design fails closed, and review other engineers’ code
• Talk with customers’ security teams about how verification works and what they need from it
• Be the engineer others ask “is this safe?”, and answer with a pull request

What We’re Looking For

• Production experience with PKI or signing systems: certificate lifecycles, key management (KMS/HSM), signature verification, and the failure modes of each
• The ability to explain digital signatures, chain validation and revocation in practical terms, and to spot where a design fails open
• Solid backend engineering in Go or a comparable language. You ship features as well as findings
• Secure-by-default instincts backed by examples: a pipeline you hardened, an incident you handled, a CVE you coordinated
• The ability to explain security to non-security engineers openly, weighing risk against shipping honestly
• Excellent communication skills and comfort working across disciplines

Strong Assets

• Supply-chain security ecosystem work: sigstore, in-toto, SLSA, TUF, SBOM tooling, or OpenSSF involvement
• Post-quantum migration experience
• Regulatory or compliance-adjacent engineering (CRA, NIS2, SOC 2, FedRAMP)
• If you’ve contributed to sigstore, TUF, in-toto or similar projects, or run PKI or signing infrastructure in production, we’d especially like to hear from you

Compensation

We compensate well — a strong base salary plus potential for bonuses.

Benefits

• Dental care
• Extended health care
• Vision care
• On-site parking

Work Location: In person, Waterloo, Ontario.