Application Security Engineer

Accountabilities

• Automate security controls: Integrate security testing tools, including SAST, DAST, and SCA, into CI/CD pipelines using platforms such as GitHub and GitLab to identify vulnerabilities before production.

• Develop secure SDLC practices: Design, maintain, and communicate developer-friendly security processes, frameworks, and threat modeling methodologies.

• Manage the bug bounty program: Coordinate private bug bounty activities, monitor program spending, triage vulnerability reports, and improve mean time to mitigation (MTTM).

• Strengthen engineering capabilities: Deliver secure coding training, share application security best practices, and build a network of Security Champions across Engineering.

• Conduct application security reviews: Perform threat modeling and secure code reviews for Java and Python microservices.

• Promote security awareness: Collaborate with communications teams to develop technical content, coordinate vulnerability disclosures, and highlight security engineering practices.

• Partner across teams: Work closely with Security and Engineering stakeholders to embed practical, developer-centric security measures across a globally distributed organization.

Requirements:

• Relevant experience: 3–5+ years of dedicated experience in Application Security and/or full-stack development.

• Secure code assessment: Practical experience reviewing Java and Python applications for security vulnerabilities.

• Security tooling and automation: Strong familiarity with integrating SAST and DAST tools into modern CI/CD workflows, including tools such as GitHub Advanced Security, OWASP ZAP, Burp Suite, Synopsys, Veracode, and Semgrep.

• Bug bounty management: Hands-on experience operating bug bounty programs, triaging findings, and defining program metrics and KPIs.

• Threat modeling: Practical experience applying methodologies such as STRIDE to assess application and system risks.

• Communication and collaboration: Strong communication skills and the ability to build trust and collaborate effectively with engineering teams.

• Education: A bachelor's degree is a plus.

• Preferred industry experience: Background in cloud-native environments, high-growth companies, or pre-IPO fintech startups is an advantage.

• Cloud security: Hands-on experience with AWS security controls and cloud infrastructure is beneficial.

• Remote collaboration: Comfort working in a fully remote, globally distributed environment.

• Personal approach: Curiosity, creative problem-solving, adaptability, and a strong sense of ownership in a fast-paced environment.

Benefits:

• Salary: The advertised annual salary range is $175,000–$230,000. The original posting does not clarify whether this range applies to Canadian hires or how compensation is adjusted by location.

• Equity: Early equity opportunities.

• Retirement savings: 401(k) plan with a 4% employer match and immediate vesting, applicable to US employees only.

• Health and wellness: Medical, dental, and vision insurance; HSA/FSA options; life and disability insurance; and pet insurance.

• Time off: Flexible paid time off, paid national holidays, and a global parental leave program.

• Professional development: Learning stipend, internal promotion opportunities, lunch-and-learn sessions, team events, and company summits.

• Remote-work support: Remote and hybrid work options, flexible working hours, and an internet stipend.

• Workspace support: Office setup stipend, applicable to US employees only.

• Additional perks: Employee discount platform and weekly office lunches for eligible office-based employees.

• Work arrangement: Remote-first, with hybrid attendance required for employees living within 30 miles of an office location.

• Canadian hiring locations: The role is open to candidates in Ontario, Alberta, and British Columbia. Some listed benefits and compensation details may vary by country; Canadian-specific eligibility should be confirmed during the application process.