Application Security Engineer

• Operate and maintain application security scanning tools, including Static Application Security Testing (SAST), Software Composition Analysis (SCA), secrets scanning, and container scanning, throughout the software development lifecycle.
• Review and triage security findings, validate true positives, assess potential risks, and collaborate with engineering teams to prioritize remediation activities.
• Track vulnerabilities from identification through resolution, ensuring remediation progress is monitored and service-level agreements (SLAs) are met.
• Support the onboarding of new repositories and services into existing security scanning tools and workflows.
• Collaborate with developers and other stakeholders to communicate findings clearly, provide actionable remediation guidance, and encourage secure development practices.
• Maintain internal documentation, operational runbooks, and procedures while identifying opportunities to improve security processes and workflows.
• Assist senior team members with basic scripting, automation, and tool integration tasks to streamline repetitive activities and improve program efficiency.

Requirements

• 2–4 years of experience in application security, security engineering, software engineering, quality assurance (QA), or a related technical role.
• Working knowledge of common application vulnerabilities, particularly the OWASP Top 10, and familiarity with secure software development lifecycle (SSDLC) practices.
• Basic scripting skills, preferably in Python, with an interest in automating repetitive tasks and improving security workflows.
• Ability to analyze security scan results, distinguish genuine vulnerabilities from false positives, and prioritize findings based on risk and impact.
• Familiarity with security tooling and vulnerability management processes, with strong attention to detail and the ability to manage findings across multiple tools and projects.
• Clear communication and collaboration skills, particularly when explaining technical security issues and remediation recommendations to software developers.
• Familiarity with CI/CD pipelines and the integration of automated security scans into development workflows is an asset.
• Exposure to tools such as DefectDojo, Dependency-Track, TruffleHog, Trivy, and/or Semgrep is considered an advantage.
• Motivation to develop further expertise in security tool integrations, automation, and custom security rule development.

Benefits

• Remote flexibility: Work remotely from Canada, with an emphasis on maintaining a healthy work-life balance.
• Competitive benefits: Access to health benefits, including a stated $175,000 maximum benefit limit (MBL) and one free dependent after one year of service, subject to the applicable plan terms.
• Additional rewards: Punctuality bonus and a generous vacation policy.
• Inclusive culture: Join a diverse, collaborative environment that values belonging, different perspectives, and authentic self-expression.
• Employee communities: Connect with colleagues through more than 20 affinity groups and participate in initiatives that foster connection and inclusion.
• Learning and development: Benefit from mentoring, opportunities to explore different areas of the business, and the chance to take on new challenges as your skills develop.
• Career growth: Build your expertise in application security, vulnerability management, security automation, and tooling within a team that supports ongoing professional development.