About the role

Senior Application Security Engineer penetration-testing AI, web, API, and AWS systems. Securing Forward Financing’s technology for small-business funding.

Responsibilities

Conduct manual penetration tests against company systems
Build AI-assisted tooling and automation to extend penetration-test coverage
Define and implement testing approaches for LLM applications, agents, and agent-generated code
Triage SAST findings, remediate real vulnerabilities, and tune false-positive rules
Perform secure code reviews across web applications, APIs, and AWS infrastructure
Build tooling and security services within the Forward application stack
Support test-to-production reviews so AI-built work is security-reviewed before promotion
Explain security risks to engineers so they can prioritize and remediate findings

5+ years in application security, offensive security, or product security
Hands-on penetration testing and code-review experience across web applications, APIs, and AWS cloud infrastructure
Hacker mentality and curiosity about how systems break
Interest in using AI to solve problems
Understanding of AI/LLM attack surfaces, including prompt injection, insecure agent tool use, and vulnerabilities characteristic of AI-generated code
Experience with Ruby, Python, TypeScript, or Go
Experience with secure SDLC practices
Ability to communicate risk and priorities to security and software engineers
Typically a Bachelor's Degree in Computer Science or equivalent technical degree, or equivalent industry experience

Flexible work arrangements: employees may work from home, in the office, or a combination of both
Flexible hours
Medical insurance
Dental insurance
Vision insurance
Flexible time-off policy
Paid parental leave
RRSP match
Wellness reimbursement
Volunteering days
Annual professional development budget
Charitable donation match
Virtual and in-person team events and celebrations
10% annual target bonus