---
title: 'Senior Purple Team Engineer at KOHO'
canonical: 'https://feeny.ai/job/senior-purple-team-engineer-koho-canada-6aafkvwwhbdt'
type: 'job'
last_seen: '2026-09-10'
---

# Senior Purple Team Engineer at KOHO

- **Company:** KOHO
- **Location:** Canada
- **Employment:** full-time
- **Work type:** remote
- **Posted:** 2026-07-17
- **Last confirmed live:** 2026-09-10
- **Apply:** https://jobs.ashbyhq.com/koho/7154d079-6b1c-45cb-a644-378c0cd373cd

## Job description

## About KOHO

We’re on a mission to make financial services better for every Canadian. That means no hidden fees, no predatory interest rates - just financial products designed to help our users spend smart, save more, and build real wealth. We’re a performance organization with a strong heart: we care deeply about outcomes, and everything ties back to our mission - to financially empower a generation of Canadians. At KOHO, we’re not your average 9-5. We believe real impact comes from people who are trusted, empowered, and supported to do their best work - without sacrificing their lives to do it. We prioritize work-life integration, not just work-life balance. That means asynchronous collaboration, flexible hours, and a remote-first setup built around autonomy and high trust. KOHO is entering its next chapter - leaner, smarter, more AI-integrated. We’re building for impact, not bureaucracy. If you thrive in environments that value clarity, ownership, and bold thinking, you’ll fit right in.

## About The Role

We’re looking for a Senior Purple Team Engineer to join our team for a role to work remotely based in Canada. Are you someone that has been doing incident response but would like to also have a technical component to your job? Or vice-versa? You are the coach. You build company-wide preparedness for a cyber incident, starting with the security team and extending across KOHO. When an incident hits, you're part of the response team, stepping in as incident commander or supporting, depending on context and what the situation requires. In addition to incident response, this role is responsible for building KOHO's deception engineering program from the ground up. This covers both internal detection assets (honeypots, canary tokens, decoy users, breadcrumbs) and external-facing deception (fake credentials, canary tokens embedded in customer-facing surfaces, and decoy infrastructure seeded in attacker-accessible surfaces). The program generates threat intelligence that feeds back into detection logic, playbooks, and KOHO's broader threat model. Reporting to our Senior Manager, Product Security you’re going to be a part of a team that does.

## What You’ll Be Doing

- Own and lead incident response readiness across KOHO. Starting with the security team, conduct regular tabletop exercises and playbook reviews.
- Plan and execute adversarial simulations: scope engagements, operate within defined rules of engagement, conduct offensive operations, and deliver findings that drive measurable security improvements.
- Expand incident response readiness across KOHO and build response playbooks for marketing, data, legal, people & culture, risk, etc.
- Conduct table top exercises with c-level to test risk acceptance and limitations.
- Document lessons learned, operational improvements, and playbook updates. Execute all improvements.
- Lead incident response/DFIR during a cybersecurity incident.
- Conduct post incident documentation to determine contributing factors and lessons learned.
- Design and deploy internal deception assets to detect lateral movement, insider threats, and unauthorized access across KOHO's environment.
- Build external-facing deception capabilities, including fake credentials, canary tokens embedded in customer-facing surfaces, and decoy infrastructure seeded in breach databases and other attacker-accessible surfaces.
- Instrument deception assets to generate actionable threat intelligence and feed findings back into detection logic, playbooks, and the broader threat model.
- Build the triage and response workflow for deception-triggered alerts into existing SOC operations, from signal to investigation to lessons learned.

## Who You Are

- Bachelor’s degree in computer science, technology management, or related technical or management field.
- You are a self-starter who can build programs from the ground up and build operations .
- Hands on experience and working understanding of AWS.
- Experience designing and deploying deception programs covering both internal detection assets and external-facing deception infrastructure.
- Strong knowledge in MITRE ATT&CK and cyber kill chain
- Hands-on experience planning and executing adversarial simulations, including scoping engagements, defining rules of engagement, and delivering post-engagement reporting.
- Experience operating offensive security tooling and techniques to emulate real-world threat actor behaviour.

The budgeted salary range for this role is $160,000 - 190,000 CAD / year. At KOHO, we are dedicated to providing pay transparency to all candidates. Compensation at KOHO is determined through various factors including but not limited to: comparable salary market data within Canada, technical skill assessment, a holistic view of previous work history, and internal pay equity with other KOHO team members.

Description de poste en français

À propos du poste Nous sommes à la recherche d’un ingénieur principal d'équipe mauve (Senior Purple Team Engineer) pour pourvoir un poste en télétravail partout au Canada. Vous spécialisez-vous en réponse aux incidents, mais aimeriez intégrer un volet plus technique à vos fonctions? Ou inversement? Vous agirez à titre de coach. Votre rôle consistera à préparer l’ensemble de l’entreprise à faire face aux cyberincidents, en commençant par l’équipe de sécurité pour ensuite étendre cette culture à tout KOHO. Lorsqu’un incident survient, vous faites partie de l’équipe d'intervention en agissant comme commandant d'incident ou en offrant votre soutien, selon le contexte et les exigences de la situation. En plus de la réponse aux incidents, vous serez responsable de bâtir entièrement le programme d’ingénierie de la déception (deception engineering) de KOHO. Ce volet englobe à la fois les actifs de détection internes (pots de miel/honeypots, jetons canaris/canary tokens, utilisateurs leurres, miettes de pain/breadcrumbs) et la déception externe (identifiants fictifs, jetons canaris intégrés dans les interfaces clients et infrastructures leurres placées dans des zones accessibles aux attaquants). Ce programme génère des renseignements sur les menaces (threat intelligence) qui viennent alimenter nos logiques de détection, nos scénarios de réponse (playbooks) et le modèle global de menaces de KOHO. Relevant de notre gestionnaire principal de la sécurité des produits, vous ferez partie d'une équipe résolument axée sur l'action.

Vos responsabilités

- Assurer et diriger la préparation à la réponse aux incidents à l'échelle de KOHO. En commençant par l'équipe de sécurité, organiser régulièrement des simulations théoriques (tabletop exercises) et des révisions de scénarios de réponse.
- Planifier et exécuter des simulations contradictoires (adversarial simulations) : définir la portée des mandats, opérer selon des règles d'engagement précises, mener des opérations offensives et présenter des conclusions qui génèrent des améliorations mesurables en matière de sécurité.
- Élargir la préparation à la réponse aux incidents à travers KOHO et concevoir des scénarios d'intervention pour les équipes du marketing, des données, des affaires juridiques, de la culture et du talent (RH), des risques, etc.
- Animer des simulations théoriques avec la haute direction (C-level) afin de tester la tolérance aux risques et les limites organisationnelles.
- Documenter les leçons apprises, les améliorations opérationnelles et les mises à jour des scénarios de réponse. Mettre en œuvre l'ensemble de ces améliorations.
- Diriger la réponse aux incidents et l'analyse informatique légale (DFIR) lors d'un cyberincident.
- Prendre en charge la documentation post-incident afin de déterminer les facteurs contributifs et les leçons apprises.
- Concevoir et déployer des actifs de déception internes pour détecter les mouvements latéraux, les menaces internes et les accès non autorisés au sein de l'environnement de KOHO.
- Bâtir des capacités de déception externes, incluant de faux identifiants, des jetons canaris intégrés aux interfaces clients et des infrastructures leurres injectées dans des bases de données compromises ou d'autres surfaces accessibles aux attaquants.
- Configurer les outils et actifs de déception afin de générer des renseignements exploitables sur les menaces et intégrer ces résultats dans la logique de détection, les scénarios de réponse et le modèle de menaces global.
- Intégrer le flux de travail de triage et de réponse lié aux alertes de déception au sein des opérations existantes du SOC (du signal initial à l'enquête, jusqu'aux leçons apprises).

Votre profil

- Baccalauréat en informatique, en gestion des technologies ou dans un domaine technique ou de gestion connexe.
- Autonomie et esprit d'initiative : vous êtes capable de bâtir des programmes et des structures opérationnelles à partir de zéro.
- Expérience pratique et solide compréhension de l'environnement AWS.
- Expérience démontrée dans la conception et le déploiement de programmes de déception, couvrant à la fois les actifs de détection internes et les infrastructures de déception externes.
- Excellente connaissance de la matrice MITRE ATT&CK et de la chaîne de cyberdestruction (cyber kill chain).
- Expérience pratique dans la planification et l'exécution de simulations contradictoires, incluant la définition de la portée, l'établissement des règles d'engagement et la production de rapports post-évaluation.
- Expérience d'utilisation des outils et techniques de sécurité offensive pour émuler le comportement de cyberattaquants réels.

Échelle salariale budgétisée pour ce poste : 160 000 $- 190 000$ CAD / année. Chez KOHO, nous nous faisons un point d'honneur d'offrir une totale transparence salariale à l'ensemble des candidats. La rémunération chez KOHO est déterminée en fonction de plusieurs facteurs, incluant notamment : les données comparatives du marché salarial au Canada, l'évaluation des compétences techniques, une analyse globale de l'historique professionnel ainsi que l'équité salariale interne avec les autres membres de l'équipe KOHO. KOHO is for builders.

If you’re energized by challenge, motivated by mission, and want to be part of a team that punches above its weight - we want to hear from you.

The KOHO culture is one of collaboration, creativity, and diverse perspectives. We are committed to building and fostering an inclusive, accessible environment for everyone. If you have any questions, concerns, or requests regarding accessibility needs, please contact peopleaccessibility@koho.ca and the People and Culture team will be happy to help.

AI Disclosure: KOHO uses artificial intelligence (AI) in certain aspects of its recruitment process to screen, assess, or select applicants. For any questions or concerns, please contact us at talent@koho.ca.

Note: this posting is for an existing vacancy that we are seeking to fill.

#LI-Remote

## About KOHO

## Company Overview
- **One-liner**: KOHO is a Canadian fintech company that provides a mobile-first spending, saving, credit-building, and investing platform to help Canadians achieve financial progress.
- **Entity Type**: Private (Venture-backed)
- **Headquarters**: Toronto, Ontario, Canada
- **Founded**: 2014
- **Founders**: Daniel Eberhard (CEO), Jonathan Belanger, Laurent Crenier

## Core Business
- **Primary industry**: Fintech / Digital Banking / Consumer Finance
- **Target customers**: B2C – Canadian consumers, from students to high-earners, seeking an alternative to traditional banks.
- **Mission or purpose statement**: To build better financial solutions for all Canadians, providing open, intuitive products designed to help them live a better life. [koho.ca](https://www.koho.ca/about/)

## Products & Services
- **KOHO Spending Account**: A digital spending account with a Mastercard (physical or virtual) offering up to 2% cash back on everyday purchases. Includes real-time transaction notifications, budgeting tools, and no hidden fees.
- **KOHO Savings**: High-interest savings options with up to 3.5% interest on balances (funds held in trust with CDIC member institutions).
- **KOHO Credit Building**: A feature that allows users to build their credit history by reporting on-time payments to credit bureaus (Equifax and TransUnion).
- **KOHO Borrow**: A line of credit and overdraft protection feature for users who need access to extra cash.
- **KOHO Crypto Trading**: A feature enabling users to buy and sell cryptocurrencies within the app.
- **KOHO Everything Account**: A premium subscription plan (with a free 30-day trial) that bundles all features, including higher cashback, higher interest, and more benefits.

## Market Standing
- **Valuation/Market Cap**: Not publicly disclosed (last reported at ~$250M CAD valuation in 2021 per news reports, but current figure is not confirmed).
- **Key Metric**: Over **2.5 million** happy customers (as of 2025). [koho.ca](https://www.koho.ca/)
- **Total Funding**: Over **$230 million CAD** raised (including debt and equity).
- **Notable Investors/Partners**: Drive Capital, Portag3 Ventures, TTV Capital, HOOPP (Healthcare of Ontario Pension Plan), Round13 Capital, BDC Capital. Partnered with Mastercard. [koho.ca](https://www.koho.ca/about/)
- **Growth Signals**: Rated **#1 Canadian Financial App** (4.8 stars on the App Store). Strong employee engagement scores (4.3/5 overall in H2 2025). [koho.ca](https://www.koho.ca/culture/)

## Competitive Advantages
- **User-First Design**: A genuinely mobile-first, fee-free banking alternative that prioritizes user experience over hidden fees.
- **All-in-One Platform**: Combines spending, saving, credit, borrowing, and investing in a single app, reducing the need for multiple banking relationships.
- **Trust & Security**: Employs 256-bit encryption (bank-grade security) and holds savings funds in trust with CDIC member institutions.
- **Strong Canadian Brand**: Deeply rooted in the Canadian market with a mission that resonates locally, differentiating it from US-based neobanks.

## Strategic Focus
- **Product Expansion**: Continuing to add new features (e.g., crypto trading, credit building) to become a comprehensive financial hub.
- **User Growth**: Scaling beyond 2.5 million users while maintaining high app ratings and customer satisfaction.
- **Profitability Path**: Likely focused on unit economics and sustainable growth, having raised significant funding and now expanding revenue through subscription plans and lending.
- **Remote-First Culture**: Fully remote environment, allowing hiring across Canada and reducing office overhead.

## Why Work Here
- **Culture & Mission**: Purpose-driven work with a clear mission to help Canadians make financial progress. High employee engagement scores (4.3/5 overall in H2 2025) and strong scores on Mission (4.6) and Belonging (4.5). [koho.ca](https://www.koho.ca/culture/)
- **Remote-First**: Fully remote company – work from anywhere in Canada. Culture is built on shared ownership and high standards, not ping-pong tables.
- **Compensation & Benefits**: Competitive salary, stock options, annual merit increases, holiday bonus, generous PTO, Health & Lifestyle spending accounts, $1,000 remote office setup budget, $5,000 referral bonus, and a free KOHO Everything account. [koho.ca](https://www.koho.ca/culture/)
- **Growth & Development**: $2,000 annual training allowance, in-house coaching program, leadership development program, internal mobility, and regular feedback on performance.
- **Values-Driven**: Emphasizes "User First," "Dynamism" (speed and sound judgment), "Warmth" (openness and candor), "Craft" (pursuit of excellence), and "Anti-Cynical" / "Anti-Complacent" attitudes. [koho.ca](https://www.koho.ca/culture/)

## Sources
1. [koho.ca](https://www.koho.ca/) – Official website (product features, customer count, app rating)
2. [koho.ca/about](https://www.koho.ca/about/) – About page (mission, investors, partners)
3. [koho.ca/culture](https://www.koho.ca/culture/) – Culture page (values, benefits, employee engagement scores)
4. [jobs.ashbyhq.com/koho](https://jobs.ashbyhq.com/koho) – Careers page (open roles)
5. [crunchbase.com](https://www.crunchbase.com/organization/koho) – Funding history and investors (for total funding figure)
6. [techcrunch.com](https://techcrunch.com/2021/05/11/koho-raises-86m/) – 2021 funding round news (for valuation context)

## Other roles at KOHO

- [Director - Financial Crime Office (Deputy AML Officer); Head of Regulatory Relations and Testing](https://feeny.ai/job/director-financial-crime-office-deputy-aml-officer-head-of-regulatory-relations-cy46k40pe9jx) — Canada
- [Director - Privacy Office (Deputy Chief Privacy Officer); Head of Advisory and RCM](https://feeny.ai/job/director-privacy-office-deputy-chief-privacy-officer-head-of-advisory-and-rcm-dztv0qbye7yf) — Canada
- [Analytics Engineer](https://feeny.ai/job/analytics-engineer-koho-canada-kh98zvmq6at6) — Canada
- [Collections & Recoveries Strategy Manager](https://feeny.ai/job/collections-recoveries-strategy-manager-koho-canada-85mdxx949k81) — Canada
- [Senior Product Designer](https://feeny.ai/job/senior-product-designer-koho-canada-5se3ha1sfz7q) — Canada
- [Manager/Senior Manager, Operational Risk & Controls](https://feeny.ai/job/manager-senior-manager-operational-risk-controls-koho-canada-mvt2apnxm2ac) — Canada
- [Senior Legal Counsel, Product and Regulatory](https://feeny.ai/job/senior-legal-counsel-product-and-regulatory-koho-canada-z2j0qgqwyf5r) — Canada