Application Security Engineer II

his position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an Application Security Engineer II based in Canada. This is an application security engineering role focused on making secure development the easiest path for product and engineering teams. You’ll help embed security directly into architectures, developer workflows, tooling, and infrastructure rather than relying on manual or reactive controls. The role combines hands-on security engineering with threat modeling, risk assessment, vulnerability remediation, and cross-functional collaboration. You’ll work closely with engineering, product, platform, and data teams to identify meaningful risks and develop practical, risk-informed solutions. As the organization expands its use of AI-powered products and services, you’ll help evolve security practices across increasingly complex systems and data flows. Your work will reduce recurring vulnerabilities, improve secure-by-default practices, and enable teams to innovate with greater confidence. This remote opportunity is well suited to an experienced security-minded engineer who takes ownership, communicates clearly, and enjoys solving complex problems collaboratively. Accountabilities: - Own and deliver application security initiatives within defined projects, products, or technical domains. - Contribute to broader cross-functional security programs by independently executing well-defined components of larger initiatives. - Identify, assess, prioritize, and help remediate application security vulnerabilities in partnership with engineering teams. - Apply secure-by-default patterns, approved architectures, and reusable security practices when designing or reviewing systems. - Partner with Product and Engineering teams to assess security risks and recommend practical improvements based on risk, business context, and technical feasibility.

- Participate in application security design reviews and threat modeling exercises for both new and existing systems. - Write and review code, technical documentation, and security guidance to address vulnerabilities and prevent recurring classes of security issues. - Help embed security controls into developer workflows, architectures, tooling, and infrastructure to reduce friction and cognitive load for engineering teams. - Participate in security incident response activities and contribute to post-incident analysis, lessons learned, and remediation efforts. - Collaborate with more experienced security engineers and cross-functional partners to continuously strengthen application and cloud security practices. - Promote a security culture that enables engineering teams to move quickly while maintaining customer trust and reducing meaningful risk. Requirements: - 4+ years of professional experience in software engineering, application security, or a closely related field. - Practical experience with application security practices including threat modeling, secure design patterns, authentication and authorization, secrets management, and vulnerability remediation. - Strong understanding of secure coding principles and common application security risks, including the OWASP Top 10. - Ability to assess security risks, break down complex technical problems, evaluate tradeoffs, and recommend practical solutions. - Experience collaborating directly with software engineers and product teams to integrate security into development and architecture processes. - Strong sense of ownership, with the ability to independently manage assigned work, maintain momentum, and follow through to completion. - Clear written and verbal communication skills, including the ability to explain security concepts and vulnerabilities to engineers with varying levels of security expertise. - Sound technical judgment and the ability to balance security requirements with product, engineering, and business priorities.