Application Security Engineer
- Canada
Contract
Applications open in a new tab.
Job details
- Job type
- Contract
- Posting language
- English
- Posted
Original job description
Job description:
What they'll do:
- Remediate application security findings hands-on: read the code, write the fix, open the PR. This is a dev-facing role, not a ticket-filing role.
- Deploy, configure, and tune SAST and SCA tooling in our CI/CD pipelines and repos, including rule tuning and false positive cleanup.
- Triage findings from SAST, SCA, and pen tests, prioritize them, and drive them to closure with engineering teams.
- Review PRs and designs for security issues and help build secure coding guidance for developers.
What we need:
- Software development background in Python and Go. Must be comfortable writing production code and opening PRs.
- Hands-on AppSec experience, especially vulnerability remediation (OWASP Top 10, dependency vulns, secrets, auth/session issues).
- Direct experience deploying and operating SAST and SCA tools in CI/CD, not just consuming their output.
- Works well with developers and can explain findings in plain language.
- Available during US business hours.
Nice to have: healthcare or other regulated-industry experience.
More about this job
Responsibilities
Remediate application security findings by reviewing code, implementing fixes, and submitting pull requests, while deploying and tuning SAST and SCA tools in CI/CD pipelines and repositories. Triage and prioritize security findings, drive them to resolution with engineering teams, and review code and designs while supporting secure coding practices.
Requirements
Requires a software development background in Python and Go, comfort writing production code and submitting pull requests, and hands-on application security experience focused on vulnerability remediation. Candidates must have direct experience operating SAST and SCA tools in CI/CD, communicate effectively with developers, and be available during US business hours; regulated-industry experience is a plus.
Skills
- Application Security
- Python
- Go
- Vulnerability Remediation
- SAST
- SCA
- CI/CD
- Security Triage
- Secure Code Review
- Secure Coding Guidance
- OWASP Top 10
- Dependency Vulnerability Management
- Secrets Management
- Authentication and Session Security
- Developer Collaboration
Visa sponsorship
Not detected in the job text
Categories
- Software
- Technology
- Security & Safety
Keywords
- Application Security
- Python
- Go
- Production Code
- Pull Requests
- Vulnerability Remediation
- OWASP Top 10
- Dependency Vulnerabilities
- Secrets
- Authentication
- Session Security
- SAST
- SCA
- CI/CD Pipelines
- Repositories
- Rule Tuning
- False Positive Cleanup
- Penetration Testing
- Security Triage
- Code Review
- Design Review
- Secure Coding
- Developer Guidance
- Healthcare
- Regulated Industries