About this role
Protecting enterprise foundation AI models and end-to-end products from evolving security threats requires bridging the gap between high-level business risks and deep technical defense. Cohere needs a Manager of Security Engineering to shape the long-term vision for the security team, oversee critical vulnerability management programs, and ensure application security practices align with standards like ISO 27001 and the OWASP Top 10 for LLMs.
This person will lead and mentor a growing group of security engineers while embedding secure engineering principles directly into CI/CD pipelines and the software development lifecycle. Responsibilities include running static and dynamic application security testing, managing bug bounty programs, and leading internal and external penetration testing engagements across web applications, APIs, networks, and agentic AI platforms. The ideal candidate functions as a trusted advisor to leadership, balances technical trade-offs between building solutions versus buying tools, and operates effectively in ambiguous environments.
What you will do
- Execute the long-term vision for the Security team in alignment with broader product and business goals.
- Develop and implement enterprise-wide vulnerability management processes, tooling, remediation tracking, and reporting.
- Establish static and dynamic application security testing programs and integrate scanning tools into CI/CD pipelines.
- Lead internal and external penetration testing engagements and manage the bug bounty program.
- Embed secure practices throughout the software development lifecycle by collaborating closely with engineering and product teams.
- Lead, hire, coach, and grow a high-performing team of security engineers.
- Establish key security metrics and communicate security posture and business risks to technical and non-technical stakeholders.
What you need
- Bring 8+ years of previous experience in Application Security or Security Engineering with a strong focus on vulnerability management, SDLC, and bug bounty programs.
- Demonstrate proven experience with SAST, DAST, and penetration testing methodologies and tools.
- Show proficiency with programming languages such as Python and GoLang, alongside web technologies.
- Possess experience with cloud platforms including AWS, GCP, and Azure, as well as container security.
- Exhibit excellent communication and interpersonal skills to influence various stakeholders.
- Demonstrate experience building and managing high-performing security teams.
Benefits
- A weekly lunch stipend of $75/£75 or equivalent local currency
- Full health and dental benefits with a separate budget for mental health
- RRSP matching, 401K, and Pension Scheme
- 100% Parental Leave top-up for up to 6 months for either parent
- Annual enrichment benefits for arts, culture, fitness, wellness, and workspace improvement
- Education and learning stipend for conferences, courses, and coaching
Skills and tech stack
Questions candidates ask
What is the remote work policy for this role?
The working location is remote within the US or Canada. Cohere is remote-friendly and also maintains offices in several global cities including Toronto, London, New York City, San Francisco, Montreal, Paris, Berlin, and Seoul.
What compensation and financial perks are offered?
The salary range is CA$320K to CA$385K with offers of equity. Additional financial perks include a weekly lunch stipend, RRSP matching, 401(k), pension scheme, and various annual enrichment and education stipends.
What security standards and frameworks are used?
Application security practices must align with industry standards such as the OWASP Top 10 for LLMs and ISO 27001. The work involves managing security across web applications, APIs, networks, and agentic AI platforms.