Application Security Engineer

Accountabilities: Operate and maintain application security scanning tools, including Static Application Security Testing (SAST), Software Composition Analysis (SCA), secrets scanning, and container scanning, throughout the software development lifecycle. Review and triage security findings, validate true positives, assess potential risks, and collaborate with engineering teams to prioritize remediation activities. Track vulnerabilities from identification through resolution, ensuring remediation progress is monitored and service-level agreements (SLAs) are met. Support the onboarding of new repositories and services into existing security scanning tools and workflows. Collaborate with developers and other stakeholders to communicate findings clearly, provide actionable remediation guidance, and encourage secure development practices. Maintain internal documentation, operational runbooks, and procedures while identifying opportunities to improve security processes and workflows. Assist senior team members with basic scripting, automation, and tool integration tasks to streamline repetitive activities and improve program efficiency. Requirements 2–4 years of experience in application security, security engineering, software engineering, quality assurance (QA), or a related technical role. Working knowledge of common application vulnerabilities, particularly the OWASP Top 10, and familiarity with secure software development lifecycle (SSDLC) practices. Basic scripting skills, preferably in Python, with an interest in automating repetitive tasks and improving security workflows. Ability to analyze security scan results, distinguish genuine vulnerabilities from false positives, and prioritize findings based on risk and impact. Familiarity with security tooling and vulnerability management processes, with strong attention to detail and the ability to manage findings across multiple tools and projects. Clear communication and collaboration skills, particularly when explaining technical security issues and remediation recommendations to software developers. Familiarity with CI/CD pipelines and the integration of automated security scans into development workflows is an asset. Exposure to tools such as DefectDojo, Dependency-Track, TruffleHog, Trivy, and/or Semgrep is considered an advantage. Motivation to develop further expertise in security tool integrations, automation, and custom security rule development. Benefits Remote flexibility: Work remotely from Canada, with an emphasis on maintaining a healthy work-life balance. Competitive benefits: Access to health benefits, including a stated $175,000 maximum benefit limit (MBL) and one free dependent after one year of service, subject to the applicable plan terms. Additional rewards: Punctuality bonus and a generous vacation policy. Inclusive culture: Join a diverse, collaborative environment that values belonging, different perspectives, and authentic self-expression. Employee communities: Connect with colleagues through more than 20 affinity groups and participate in initiatives that foster connection and inclusion. Learning and development: Benefit from mentoring, opportunities to explore different areas of the business, and the chance to take on new challenges as your skills develop. Career growth: Build your expertise in application security, vulnerability management, security automation, and tooling within a team that supports ongoing professional development.