About the company
This position is listed on behalf of a partner company managing all applications and next steps. Join a collaborative security team dedicated to strengthening application security across a diverse portfolio of digital products and services.
Responsibilities
- Operate and maintain application security scanning tools (SAST, SCA, secrets scanning, container scanning) throughout the SDLC
- Review and triage security findings, validate true positives, assess risks, and collaborate with engineering teams on remediation
- Track vulnerabilities from identification through resolution, monitoring SLAs
- Support onboarding of new repositories and services into security scanning tools
- Communicate findings clearly and provide actionable remediation guidance
- Maintain internal documentation, runbooks, and procedures
- Assist senior team members with scripting, automation, and tool integration
Requirements
- 2–4 years of experience in application security, security engineering, software engineering, QA, or related
- Knowledge of OWASP Top 10 and SSDLC practices
- Basic scripting skills, preferably Python
- Ability to analyze scan results and prioritize findings by risk
- Familiarity with security tooling and vulnerability management
- Clear communication and collaboration skills
- Familiarity with CI/CD pipelines and automated security scans (asset)
- Exposure to DefectDojo, Dependency-Track, TruffleHog, Trivy, Semgrep (advantage)
Conditions
- Remote flexibility from Canada
- Health benefits with $175,000 maximum benefit limit and one free dependent after one year
- Punctuality bonus and generous vacation policy
- Inclusive culture, 20+ affinity groups
- Mentoring and learning opportunities