Senior Purple Team Engineer

About KOHO

We’re on a mission to make financial services better for every Canadian. That means no hidden fees, no predatory interest rates - just financial products designed to help our users spend smart, save more, and build real wealth. We’re a performance organization with a strong heart: we care deeply about outcomes, and everything ties back to our mission - to financially empower a generation of Canadians.

At KOHO, we’re not your average 9-5. We believe real impact comes from people who are trusted, empowered, and supported to do their best work - without sacrificing their lives to do it. We prioritize work-life integration, not just work-life balance. That means asynchronous collaboration, flexible hours, and a remote-first setup built around autonomy and high trust.

KOHO is entering its next chapter - leaner, smarter, more AI-integrated. We’re building for impact, not bureaucracy. If you thrive in environments that value clarity, ownership, and bold thinking, you’ll fit right in.

About The Role

We’re looking for a Senior Purple Team Engineer to join our team for a role to work remotely based in Canada. Are you someone that has been doing incident response but would like to also have a technical component to your job? Or vice-versa?

You are the coach. You build company-wide preparedness for a cyber incident, starting with the security team and extending across KOHO. When an incident hits, you're part of the response team, stepping in as incident commander or supporting, depending on context and what the situation requires.

In addition to incident response, this role is responsible for building KOHO's deception engineering program from the ground up. This covers both internal detection assets (honeypots, canary tokens, decoy users, breadcrumbs) and external-facing deception (fake credentials, canary tokens embedded in customer-facing surfaces, and decoy infrastructure seeded in attacker-accessible surfaces). The program generates threat intelligence that feeds back into detection logic, playbooks, and KOHO's broader threat model.

Reporting to our Senior Manager, Product Security you’re going to be a part of a team that does.

What You’ll Be Doing

• Own and lead incident response readiness across KOHO. Starting with the security team, conduct regular tabletop exercises and playbook reviews.

• Plan and execute adversarial simulations: scope engagements, operate within defined rules of engagement, conduct offensive operations, and deliver findings that drive measurable security improvements.

• Expand incident response readiness across KOHO and build response playbooks for marketing, data, legal, people & culture, risk, etc.

• Conduct table top exercises with c-level to test risk acceptance and limitations.

• Document lessons learned, operational improvements, and playbook updates. Execute all improvements.

• Lead incident response/DFIR during a cybersecurity incident.

• Conduct post incident documentation to determine contributing factors and lessons learned.

• Design and deploy internal deception assets to detect lateral movement, insider threats, and unauthorized access across KOHO's environment.

• Build external-facing deception capabilities, including fake credentials, canary tokens embedded in customer-facing surfaces, and decoy infrastructure seeded in breach databases and other attacker-accessible surfaces.

• Instrument deception assets to generate actionable threat intelligence and feed findings back into detection logic, playbooks, and the broader threat model.

• Build the triage and response workflow for deception-triggered alerts into existing SOC operations, from signal to investigation to lessons learned.

Who You Are

• Bachelor’s degree in computer science, technology management, or related technical or management field.

• You are a self-starter who can build programs from the ground up and build operations .

• Hands on experience and working understanding of AWS.

• Experience designing and deploying deception programs covering both internal detection assets and external-facing deception infrastructure.

• Strong knowledge in MITRE ATT&CK and cyber kill chain

• Hands-on experience planning and executing adversarial simulations, including scoping engagements, defining rules of engagement, and delivering post-engagement reporting.

• Experience operating offensive security tooling and techniques to emulate real-world threat actor behaviour.

The budgeted salary range for this role is $170,000 - 220,000CAD / year.

At KOHO, we are dedicated to providing pay transparency to all candidates. Compensation at KOHO is determined through various factors including but not limited to: comparable salary market data within Canada, technical skill assessment, a holistic view of previous work history, and internal pay equity with other KOHO team members.

French job description

About the role

We are looking for a Senior Purple Team Engineer (ingénieur principal d'équipe mauve) to fill a remote position anywhere in Canada. Do you specialize in incident response but would like to add a more technical component to your duties? Or the reverse?

You will act as a coach. Your role will consist of preparing the entire company to face cyber incidents, starting with the security team and then extending this culture to all of KOHO. When an incident occurs, you are part of the response team, acting as incident commander or providing support, depending on the context and the demands of the situation.

In addition to incident response, you will be responsible for building KOHO's deception engineering program (deception engineering) from the ground up. This covers both internal detection assets (honeypots, canary tokens, decoy users, breadcrumbs) and external deception (fake credentials, canary tokens embedded in client interfaces, and decoy infrastructure placed in areas accessible to attackers). This program generates threat intelligence that feeds into our detection logic, our response playbooks, and KOHO's overall threat model.

Reporting to our Senior Manager, Product Security, you will be part of a team that is firmly focused on taking action.

Your Responsibilities

• Ensure and lead incident response readiness across KOHO. Starting with the security team, regularly organize tabletop exercises and reviews of response playbooks.

• Plan and execute adversarial simulations: define the scope of engagements, operate according to precise rules of engagement, conduct offensive operations, and present findings that generate measurable security improvements.

• Extend incident response readiness across KOHO and design response scenarios for the marketing, data, legal, culture and talent (HR), risk teams, and others.

• Lead tabletop exercises with senior management (C-level) to test risk tolerance and organizational limits.

• Document lessons learned, operational improvements, and response playbook updates. Implement all of these improvements.

• Lead incident response and digital forensics and incident response (DFIR) during a cyber incident.

• Take charge of post-incident documentation to determine contributing factors and lessons learned.

• Design and deploy internal deception assets to detect lateral movement, insider threats, and unauthorized access within KOHO's environment.

• Build external deception capabilities, including fake credentials, canary tokens integrated into client interfaces, and decoy infrastructure injected into compromised databases or other surfaces accessible to attackers.

• Configure deception tools and assets to generate actionable threat intelligence and integrate these results into detection logic, response playbooks, and the overall threat model.

• Integrate the triage and response workflow for deception-related alerts into existing SOC operations (from initial signal to investigation, through to lessons learned).

Your Profile

• Bachelor's degree in computer science, technology management, or a related technical or management field.

• Self-direction and initiative: you are able to build programs and operational structures from scratch.

• Practical experience and a solid understanding of the AWS environment.

• Proven experience designing and deploying deception programs, covering both internal detection assets and external deception infrastructure.

• Excellent knowledge of the MITRE ATT&CK matrix and the cyber kill chain.

• Practical experience planning and executing adversarial simulations, including defining scope, establishing rules of engagement, and producing post-assessment reports.

• Experience using offensive security tools and techniques to emulate the behaviour of real cyberattackers.

Budgeted salary range for this position: 170,000 $ - 220,000 $ CAD / year.

At KOHO, we take pride in offering full salary transparency to all candidates. Compensation at KOHO is determined by several factors, including: comparative salary market data in Canada, technical skills assessment, a comprehensive review of professional history, and internal pay equity with other KOHO team members.

KOHO is for builders.

If you're energized by challenge, motivated by mission, and want to be part of a team that punches above its weight - we want to hear from you.

The KOHO culture is one of collaboration, creativity, and diverse perspectives. We are committed to building and fostering an inclusive, accessible environment for everyone. If you have any questions, concerns, or requests regarding accessibility needs, please contact peopleaccessibility@koho.ca and the People and Culture team will be happy to help.

AI Disclosure: KOHO uses artificial intelligence (AI) in certain aspects of its recruitment process to screen, assess, or select applicants. For any questions or concerns, please contact us at talent@koho.ca.

Note: this posting is for an existing vacancy that we are seeking to fill.

#LI-Remote