Application Security Engineer securing GenAI products and emerging businesses. Building security tools, reviewing code, and improving application, cloud, and infrastructure security at Liftoff’s mobile marketing platform.
About the role
- Application security leader strengthening Spring Financial’s Canadian fintech platforms. Driving secure development, cloud security, AI security, compliance, and incident response.
Responsibilities
- Shape and drive Spring’s application security strategy and roadmap
- Lead secure development practices across engineering, including threat modeling, secure code review, dependency management, and static and dynamic analysis
- Define and manage Spring’s Secure Development Lifecycle, embedding security reviews, tooling, and guardrails into CI/CD workflows
- Partner with engineering, DevOps, and platform teams to identify and remediate risks across applications, services, APIs, and cloud environments
- Evaluate, select, and implement security tools and services such as SAST, DAST, SBOM, secrets scanning, WAF, and CSPM
- Champion responsible use of AI in application security workflows and integrate AI into security tooling and detection capabilities
- Set security standards for AI-powered features and internal AI tooling, addressing prompt injection, data leakage, and excessive agent permissions
- Own or contribute to incident response for application vulnerabilities and exposures, lead post-incident learning, and implement systemic improvements
- Support SOC 2 readiness, audit participation, evidence gathering, and privacy obligations such as PIPEDA
- Advise product and engineering teams on secure architecture, data protection, and third-party risk
- Mentor and grow the application security team and potentially lead a small team of engineers
- Track and communicate security posture through metrics, risk registers, and executive-level reporting
Requirements
- 5+ years of experience in application security, software engineering, or security engineering, including at least 2 years leading security initiatives or acting as a technical owner
- Deep knowledge of web and cloud application security principles, the OWASP Top 10, and secure coding best practices
- Proven experience implementing SDL processes and integrating security into CI/CD pipelines and agile environments
- Ability to define how vulnerabilities are prioritized, tracked, and closed, including remediation targets, exceptions, and risk acceptance
- Fluency in threat modeling frameworks such as STRIDE and PASTA and secure architecture reviews for business-critical systems
- Strong familiarity with cloud-native architecture, including AWS, microservices, containerization, and API gateways
- Deep hands-on experience operating automated security testing at scale, including tuning, noise reduction, and measuring effectiveness
- Experience with tools such as Snyk, GitHub Advanced Security, Burp Suite, Semgrep, Checkov, or similar
- Solid understanding of identity, access, and secrets management patterns, including OAuth/OIDC, SSO, token handling, cloud IAM, and least privilege
- Track record of leading cross-functional security initiatives and influencing engineering and business stakeholders without authority
- Strong grasp of AI tools relevant to application security, their responsible use, and security risks introduced by AI
- Experience supporting compliance initiatives such as SOC 2, PCI DSS, PIPEDA, or ISO 27001 is a plus
- Relevant security certification such as OSCP, OSWE, BSCP, or AWS Security Specialty is nice to have
- AI security training or certification is nice to have
- Regular hands-on security practice is nice to have
- Bug bounty findings, security research, or open-source security contributions are nice to have
- Experience building or scaling a security program at a growth-stage company is nice to have
Benefits
- Comprehensive benefits package, including extended health, dental, and vision coverage — with 100% of monthly premiums covered by the Spring
- GRSP matching program to support your long-term financial goals
- A modern, collaborative workspace in the heart of downtown Vancouver
- Ongoing career growth opportunities
- Hybrid work arrangement: 3 set days in the office and 2 WFH
Job title
Job type
Experience level
Salary
Degree requirement
No Education Requirement
Tech skills
Location requirements
Report this job
Found something wrong with the page? Please let us know by submitting a report below.
Technical application specialist supporting S&C’s electrical grid protection products and customers. Preparing proposals, coordinating orders, and applying medium - voltage protection engineering.
Application Security Engineer operating Newfold Digital’s AppSec scanning program for its global web technology products. Triaging vulnerabilities and partnering with engineering teams on remediation.
Senior engineer supporting Honeywell’s industrial automation and blending applications. Resolving customer issues, testing releases, training customers, and mentoring global support teams.
Vehicle Applications Engineer coordinating engineering requirements, bids, and bills of material for transit buses and coaches. Supporting production contracts and sales opportunities in Winnipeg.
Senior software engineer extending Auth0 and OpenFGA identity and authorization systems. Building secure permissions for human users and AI agents at Basis, a digital media automation platform.
Application Support Engineer supporting cryptocurrency trading systems and production environments. Handling incidents, releases, monitoring, automation, and L2/L3 technical support for global business users.
Senior Application Security Engineer embedding Secure by Design, threat modeling, and AI - assisted vulnerability remediation. Strengthening security for Lightspeed’s global cloud commerce platform serving merchants worldwide.
Applications Engineer developing technical and commercial quotations for Innomotics’ motors, VFDs, and drive systems. Supporting mining and heavy - industrial customers across Canada from proposal through execution.
Senior Application Security Engineer leading Trimble’s global SCA and SAST strategy. Embedding automated security into CI/CD pipelines across diverse technology stacks.