Senior Security Engineer

Overview

Own dynamic and runtime application security for a multi-product enterprise software portfolio, securing APIs, cloud architectures and AI/LLM implementations across dozens of engineering teams.

What you'll do

• Own the end-to-end execution, expansion, and optimization of enterprise DAST, IAST, API Security, and Runtime Security solutions across a multi-product portfolio.
• Establish proactive API discovery, continuous posture management, and runtime security controls while driving security initiatives for AI/LLM implementations.
• Synthesize signals across DAST, IAST, SAST, SCA, and runtime telemetry to eliminate noise and empower developers with high-fidelity, actionable risk prioritization.
• Partner with AppSec peers to integrate dynamic security automation seamlessly into CI/CD pipelines alongside SAST, SCA, Container, and IaC security tooling.
• Act as a strategic security advisor to engineering, DevOps, and product teams to modernize runtime protection across diverse technology stacks and cloud environments.

What you'll need

• 6+ years of dedicated experience in Application Security, Product Security, or Software Security Engineering within complex enterprise environments.
• Hands-on mastery with enterprise-grade DAST and IAST platforms (such as Burp Suite Enterprise, Rapid7, Veracode DAST, Contrast Security, or HCL AppScan).
• Deep understanding of API security testing (REST, GraphQL, gRPC), API gateways, and runtime defense models (RASP, eBPF monitoring, WAF/WAAP).
• Proven track record securing multi-language applications (Java, Python, Go, Node.js, C#/.NET, C++) and automating scans within modern CI/CD workflows and cloud environments (AWS, Azure, GCP).
• Strong grasp of vulnerability scoring and risk prioritization frameworks including CVSS v3/v4, EPSS, and OWASP Top 10.

Nice to have

• Hands-on experience securing AI-enabled applications, LLM wrappers, and APIs against OWASP LLM Top 10 threat vectors.
• Familiarity with neighboring AppSec domains including SAST, SCA, Container Security, and Infrastructure-as-Code scanning.
• Software engineering background with the ability to write custom automation scripts (Python, Go, Bash) and review multi-language source code.
• Relevant industry certifications such as OSCP, OSWE, GWAPT, CISSP, AWS Certified Security Specialty, or CKS.

Details

• Location: Canada, Remote.
• Travel requirement: 0-10%.