Application Security Engineer

Accountabilities: Automate security controls: Integrate security testing tools, including SAST, DAST, and SCA, into CI/CD pipelines using platforms such as GitHub and GitLab to identify vulnerabilities before production. Develop secure SDLC practices: Design, maintain, and communicate developer-friendly security processes, frameworks, and threat modeling methodologies. Manage the bug bounty program: Coordinate private bug bounty activities, monitor program spending, triage vulnerability reports, and improve mean time to mitigation (MTTM). Strengthen engineering capabilities: Deliver secure coding training, share application security best practices, and build a network of Security Champions across Engineering. Conduct application security reviews: Perform threat modeling and secure code reviews for Java and Python microservices. Promote security awareness: Collaborate with communications teams to develop technical content, coordinate vulnerability disclosures, and highlight security engineering practices. Partner across teams: Work closely with Security and Engineering stakeholders to embed practical, developer-centric security measures across a globally distributed organization. Requirements: Relevant experience: 3–5+ years of dedicated experience in Application Security and/or full-stack development. Secure code assessment: Practical experience reviewing Java and Python applications for security vulnerabilities. Security tooling and automation: Strong familiarity with integrating SAST and DAST tools into modern CI/CD workflows, including tools such as GitHub Advanced Security, OWASP ZAP, Burp Suite, Synopsys, Veracode, and Semgrep. Bug bounty management: Hands-on experience operating bug bounty programs, triaging findings, and defining program metrics and KPIs. Threat modeling: Practical experience applying methodologies such as STRIDE to assess application and system risks. Communication and collaboration: Strong communication skills and the ability to build trust and collaborate effectively with engineering teams. Education: A bachelor's degree is a plus. Preferred industry experience: Background in cloud-native environments, high-growth companies, or pre-IPO fintech startups is an advantage. Cloud security: Hands-on experience with AWS security controls and cloud infrastructure is beneficial. Remote collaboration: Comfort working in a fully remote, globally distributed environment. Personal approach: Curiosity, creative problem-solving, adaptability, and a strong sense of ownership in a fast-paced environment. Benefits: Salary: The advertised annual salary range is $175,000–$230,000. The original posting does not clarify whether this range applies to Canadian hires or how compensation is adjusted by location. Equity: Early equity opportunities. Retirement savings: 401(k) plan with a 4% employer match and immediate vesting, applicable to US employees only. Health and wellness: Medical, dental, and vision insurance; HSA/FSA options; life and disability insurance; and pet insurance. Time off: Flexible paid time off, paid national holidays, and a global parental leave program. Professional development: Learning stipend, internal promotion opportunities, lunch-and-learn sessions, team events, and company summits. Remote-work support: Remote and hybrid work options, flexible working hours, and an internet stipend. Workspace support: Office setup stipend, applicable to US employees only. Additional perks: Employee discount platform and weekly office lunches for eligible office-based employees. Work arrangement: Remote-first, with hybrid attendance required for employees living within 30 miles of an office location. Canadian hiring locations: The role is open to candidates in Ontario, Alberta, and British Columbia. Some listed benefits and compensation details may vary by country; Canadian-specific eligibility should be confirmed during the application process.