Senior Application Security Analyst

Accountabilities:

You will contribute to the ongoing development and delivery of the application security program, working closely with technical and operational stakeholders to identify, evaluate, and address security risks.

• Help refine and implement application security practices, with a focus on endpoints, applications, and underlying infrastructure.

• Collaborate with operational teams to assess existing and emerging security risks and provide subject matter expertise.

• Conduct regular security scans and coordinate with relevant stakeholders to resolve identified issues.

• Triage third-party security assessments and follow up with stakeholders to ensure findings are addressed.

• Monitor and track security risks, findings, and associated documentation throughout their lifecycle.

• Support internal teams during security assessments, reviews, and audits.

• Review independent third-party reports from vendors, suppliers, and partners to verify alignment with the application security program.

• Engage stakeholders in remediation activities and help ensure security findings are resolved effectively.

• Generate and organize security-related evidence to support audit exercises and demonstrate the implementation of security controls.

Requirements:

You bring practical application security experience, strong technical knowledge, and the ability to work independently while communicating effectively with stakeholders across engineering and operations.

• Practical programming experience and proficiency in reviewing code across multiple programming languages.

• Hands-on experience implementing information security controls across endpoint, application, and infrastructure security domains.

• Familiarity with application security testing methodologies and tools, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA).

• Hands-on experience with public cloud services such as AWS or Azure.

• Experience conducting vulnerability assessments and penetration tests.

• Experience working with security controls based on frameworks and standards such as ISO 27001, NIST 800-53, PCI-DSS, or PBMM.

• Familiarity with enterprise-grade Governance, Risk, and Compliance (GRC) tools.

• Experience assessing security control implementations in large enterprise, web-scale, and serverless environments.

• Proven ability to engage stakeholders and coordinate the remediation of security-related findings.

• Experience supporting audits by preparing and providing security-related evidence.

• Strong communication skills, including the ability to explain complex technical concepts clearly to stakeholders with different levels of technical expertise.

• Ability to engage process owners and explain the security controls associated with business and operational processes.

• Ability to work independently, learn quickly, and synthesize information from different domains and sources.

• Strong collaboration skills and the ability to work effectively with a broad range of engineering and operational teams.

• Red Team and Blue Team experience is a strong advantage.

Benefits:

• Base salary: CAD 140,000–175,000 per year, depending on relevant knowledge, skills, education, training, experience, and geographic market factors.

• Potential additional compensation through variable incentives and equity grants.

• Flexible work arrangements.

• Competitive employee benefits package.

• Wellness subsidy and wellness reimbursement.

• Access to mental health services, an Employee and Family Assistance Program (EFAP), financial planning resources, and other wellbeing support.

• Retirement planning support.

• Home internet reimbursement.

• Learning and professional development opportunities.

• Tuition reimbursement of up to CAD 4,000 for continuing education through the SkillsWave Program.

• Two paid days off for SkillsWave-related activities, such as examinations or final assignments.

• Two paid volunteer days.

• Employee referral program.

• Employee recognition initiatives and social events.

• Dog-friendly office spaces at designated offices in Kitchener, Winnipeg, Vancouver, and Melbourne.

• An inclusive workplace that values diverse backgrounds, experiences, and perspectives.

• Accessibility accommodations during the recruitment process, available upon request.