Application Security Engineer

This is a fully remote position, open to applicants in Canada.

📋 Description

• Manage and operate AppSec scanning tools, such as SAST, SCA, secrets scanning, and container scanning throughout the Software Development Life Cycle (SDLC).

• Evaluate findings, confirm true positives, and prioritize remediation efforts in collaboration with engineering teams.

• Monitor vulnerabilities until resolution and ensure compliance with Service Level Agreements (SLA).

• Assist in the integration of new repositories and services into security tools.

• Contribute to the creation of internal documentation, runbooks, and enhancements to processes.

• Support basic scripting and automation tasks under the guidance of senior team members.

⛳️ Requirements

• 2–4 years of experience in application security, security engineering, or a related software/QA engineering position.

• Proficient understanding of common vulnerability categories (OWASP Top 10) and secure SDLC methodologies.

• Basic scripting skills; Python is preferred.

• Able to communicate findings effectively to developers.

• Strong attention to detail and capability to handle a queue of findings across various tools.

• Familiarity with Defect Dojo, Dependency-Track, Truffle Hog, Trivy, and/or Semgrep is a plus.

• Understanding of CI/CD pipelines and their integration with security scans is advantageous.

• Eagerness to develop skills in tool integration, automation, or custom rule-writing over time is welcomed.

🏝️ Benefits

• Work-life balance.

• Diversity and inclusion programs.

• Opportunities for learning and development.

• Access to over 20 affinity groups for networking and connection.

• Competitive HMO benefits – 175k MBL with one complimentary dependent after one year of service.

• Punctuality Bonus.

• Generous vacation policy.

• Mentorship and opportunities for career advancement.