Application Security Engineer Ii Virtual, Ontario Engineering

Thumbtack helps millions of people confidently care for their homes.Thumbtack is the one app you need to take care of and improve your home — from personalized guidance to AI tools and a best-in-class hiring experience. Every day in every county of the U.S., people turn to Thumbtack to complete urgent repairs, seasonal maintenance, and bigger improvements. We help homeowners know projects to do, when to do them, and who to hire from our growing community of 300,000 local service businesses. If making an impact inspires you, join us. Imagine what we’ll build together.
About the Cybersecurity TeamThe Security Engineering team at Thumbtack is focused on enabling innovation at scale by making the secure path the easiest path. We believe strong security is not a blocker to velocity, but a force multiplier when it is designed into systems, platforms, and developer workflows from the start.
We partner closely with Product, Engineering, Platform, and Data teams to shape system design, guide architectural decisions, and evolve Thumbtack’s security posture as the company scales. Through collaboration, automation, and thoughtful tradeoffs, we help ensure Thumbtack can ship fast, innovate boldly, and maintain customer trust.
Hear from
“Opinions from all across the organization are
valued and listened to, and it’s easy and encouraged to get involved with a project you’re passionate about."
The ChallengeAs Thumbtack scales and increasingly incorporates AI-powered features into our products and internal systems, security must evolve without slowing innovation. The number of services, deployment patterns, and data flows continues to grow, and traditional approaches that rely heavily on manual reviews or after-the-fact controls do not scale to meet this need.
Instead, the challenge is to design security into the system itself. This means building secure defaults, paved paths, and reusable building blocks that product and engineering teams can adopt with minimal friction. By embedding security directly into architectures, tooling, and infrastructure, we reduce cognitive load on engineers and enable teams to move quickly and confidently while meaningfully lowering risk.
What you’ll do
Own and deliver application security work within defined projects or domains. Contribute to cross-functional security initiatives, executing clearly scoped pieces of larger efforts.
Identify, prioritize, and help remediate application security risks in partnership with engineering teams.
Apply secure-by-default patterns and approved architectures when designing or reviewing systems.
Partner with product and engineering teams to assess risk and recommend practical, risk-informed security improvements. Participate in application security design reviews and threat modeling for new and existing systems.
Write code, reviews, and documentation to address vulnerabilities and reduce recurring classes of issues.
Participate in security incident response and contribute to post-incident analysis and remediation.
In order to be successful, you must bring
4+ years of experience in software engineering and/or application security.
Practical experience with application security techniques such as threat modeling, secure design patterns, authentication and authorization, secrets management, and vulnerability remediation. Strong understanding of secure coding practices and common application security risks (e.G., OWASP Top 10).
Ability to assess security risks and break down complex problems, reason about tradeoffs, make sound recommendations, and deliver practical, impactful solutions with guidance when needed.
Strong sense of ownership over assigned work, with the ability to execute independently and follow through.
Clear written and verbal communication skills, including the ability to explain security issues to engineers with varying levels of security expertise.
A growth mindset and interest in learning from more senior engineers and expanding depth in both application and cloud infrastructure security over time.
Expected salary ranges
For candidates living in Ontario and British Columbia, the expected total cash compensation (base salary + variable pay, if applicable) range for this role is currently $118,200.00 - $152,900.00.
Supporting you at work and beyondIn addition to our virtual-first model, we offer:
Paid time offRecharge with PTO, in addition to 20 company-wide holidays each year, including a week-long end-of-year shutdown.
Remote work stipend and reimbursements$1,000 USD/$1,400 CAD annual stipend for professional development, self care, office set-up and more. We also provide cell phone and Wi-Fi reimbursements.
Support for parents and caregiversAll parents receive up to 12 weeks of paid parental leave, and birthing parents receive 8 additional weeks, for a total of 20 weeks of 100% paid parental leave (US & CAN).
Family formation benefits$30,000 USD/CAD lifetime max reimbursement for family planning.
Mental health and financial coaching12 coaching sessions and 12 therapy sessions for yourself and your dependents. We also offer one-on-one financial guidance from a financial wellness provider.
Thumbtack Bucks$450 USD/CAD quarterly stipend to book a pro on Thumbtack for virtual or in-person services — anything from home care services to planning a child’s birthday party and beyond.
Claude Enterprise (Claude.Ai, Claude Code, Cowork, Claude Desktop, Ask Thumbtack), OpenAI Enterprise ChatGPT & Codex, Cursor, Gemini Enterprise, Granola, Coda AI, Zoom AI Companion, Linear, and more.*Access varies based on location, team, and role.
#J-18808-Ljbffr