Product Security Specialist II

<h3>Accountabilities:</h3><li>Collaborate with developers, product managers, customer experience teams, customers, and partners to communicate security requirements clearly and adapt technical explanations to different audiences.</li><li>Manage security questionnaires, assessments, and customer or partner security meetings, providing accurate information and supporting confidence in product security practices.</li><li>Develop, maintain, and improve product security policies, standards, procedures, and documentation across key security domains.</li><li>Contribute to risk management activities by maintaining the security risk register, monitoring compliance with established policies, and identifying opportunities to strengthen security controls.</li><li>Conduct security and compliance reviews of third-party libraries, vendor components, and software dependencies, assessing licensing requirements, known vulnerabilities, and other risk indicators.</li><li>Support the AI security and governance program by developing standards for AI-assisted software development, monitoring emerging AI-related security risks, and helping deliver training and awareness initiatives for Engineering teams.</li><li>Contribute to the vulnerability disclosure process, including Common Vulnerabilities and Exposures (CVE) registration, security advisory preparation, vulnerability coordination, and post-incident reviews.</li><li>Own ongoing security coverage for applications and services developed outside core Engineering, including public-facing websites, APIs, internal tools, IT-developed scripts, and internally used AI agents.</li><li>Assess the security posture of non-engineering applications and services, identify weaknesses, and coordinate appropriate remediation and ongoing monitoring.</li><li>Support the integration of security practices throughout the software development lifecycle, including secure development standards, application security testing, and software supply chain security.</li><li>Track security performance indicators, maintain governance dashboards, and prepare reports for leadership and external stakeholders.</li><li>Analyze security findings, incomplete data, and emerging risks to prioritize actions and provide practical recommendations.</li><li>Work independently to manage assigned security domains while collaborating with the broader security team and Engineering stakeholders.</li><li>Identify opportunities to improve security processes, developer enablement, compliance practices, and overall security program maturity.</li><h2>Requirements:</h2><li>At least three years of professional experience in product security, application security, or a closely related cybersecurity discipline.</li><li>Strong technical cybersecurity knowledge, including common vulnerability classes, secure software development practices, and application security tools and methodologies.</li><li>Familiarity with the OWASP Top 10 and security testing tools and practices, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA).</li><li>Proficiency in Python for automation, security tooling, data analysis, or workflow improvement.</li><li>Experience with agentic AI systems and an understanding of the security considerations associated with AI-assisted development or autonomous AI agents.</li><li>Demonstrated ability to explain security concepts clearly to stakeholders with varying levels of technical knowledge, including engineers, business teams, customers, and external partners.</li><li>Strong analytical and problem-solving skills, with the ability to interpret complex, noisy, or incomplete information and translate findings into actionable recommendations.</li><li>Excellent written communication and documentation skills, including the ability to develop security policies, prepare technical reports, and communicate vulnerability findings effectively.</li><li>A relevant degree in Computer Science, Cybersecurity, Information Technology, or a related field, or equivalent practical experience.</li><li>Strong organizational skills and the ability to manage multiple security responsibilities, prioritize risks, and work independently with minimal supervision.</li><li>A collaborative, proactive mindset, with sound judgment, attention to detail, and a commitment to continuous learning and improvement.</li><h2>Additional qualifications considered an asset:</h2><li>Familiarity with security and compliance frameworks such as SOC 2 and ISO 27001.</li><li>Relevant professional security certifications, such as CISSP, CISM, or equivalent credentials.</li><li>Experience using, supporting, or securing FME in production environments.</li><li>Experience with vulnerability disclosure coordination, CVE registration, security advisories, or incident postmortems.</li><li>Familiarity with software supply chain security, third-party risk management, and governance of AI-enabled development tools.</li><li>Experience securing public-facing applications, APIs, internal business tools, automation scripts, or AI agents.</li><h2>Benefits:</h2><li>
<strong>Competitive salary:</strong>Annual base salary ranging from CAD $102,000 to $115,000, with potential flexibility based on qualifications, experience, and other role-related factors.</li><li>
<strong>Performance bonus:</strong>Eligibility for additional bonus compensation.</li><li>
<strong>Fully remote work:</strong>Remote working arrangements for candidates across Canada, excluding Quebec.</li><li>
<strong>Flexible working hours:</strong>Flexibility to organize your workday around your responsibilities and lifestyle.</li><li>
<strong>Comprehensive health coverage:</strong>Extended health and dental benefits beginning on your first day of employment.</li><li>
<strong>Wellness support:</strong>Access to health or lifestyle spending benefits and counseling services from day one.</li><li>
<strong>Retirement savings:</strong>RRSP/TFSA matching to support long-term financial planning.</li><li>
<strong>Shared success:</strong>Biannual profit-sharing opportunities that allow employees to participate in organizational success.</li><li>
<strong>Paid time off:</strong>Three weeks of vacation annually, plus six additional paid seasonal days off each year.</li><li>
<strong>Parental support:</strong>A parental leave top-up program for eligible employees welcoming a child through childbirth or adoption.</li><li>
<strong>Professional development:</strong>An annual learning budget and employer-funded training programs to support continuous learning and career advancement.</li><li>
<strong>Career progression:</strong>Opportunities to take ownership of specialized security domains and progress toward a senior product security role.</li><li>
<strong>Meaningful work:</strong>The opportunity to influence product security strategy, strengthen software protection, and support responsible AI adoption.</li><li>
<strong>Community engagement:</strong>Paid time off to participate in employer-organized volunteering initiatives that support community programs.</li><li>
<strong>Inclusive workplace:</strong>A collaborative environment that values diverse backgrounds, new ideas, autonomy, and continuous improvement.</li><li>
<strong>Accessible recruitment:</strong>Accommodations are available throughout the hiring process to support candidates who require them.</li>