Application Security Engineer

Overview

Help run and scale the day-to-day application security program, operating scanning tools, triaging findings, and working directly with engineering teams to get vulnerabilities fixed.

What you'll do

• Operate and maintain AppSec scanning tools (SAST, SCA, secrets scanning, container scanning) across the SDLC
• Triage findings, validate true positives, and prioritize remediation with engineering teams
• Track vulnerabilities through to closure and monitor SLA compliance
• Support onboarding of new repositories/services into the security tooling
• Contribute to internal documentation, runbooks, and process improvements
• Assist with basic scripting/automation tasks under guidance from senior team members

What you'll need

• 2–4 years in application security, security engineering, or a related software/QA engineering role
• Working knowledge of common vulnerability classes (OWASP Top 10) and secure SDLC practices
• Basic scripting ability (Python preferred) for automating repetitive tasks
• Comfortable communicating findings clearly to developers
• Strong attention to detail and ability to manage a queue of findings across multiple tools

Nice to have

• Exposure to Defect Dojo, Dependency-Track, Truffle Hog, Trivy, and/or Semgrep
• Familiarity with CI/CD pipelines and how security scans plug into them
• Interest in growing into tool integration, automation, or custom rule-writing over time

Details

• Location: Canada - Remote