Staff Application Security Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Staff Application Security Engineer based in Canada. Help establish and scale a dedicated application security function within a high-growth technology environment where protecting customers against fraud and abuse is a core priority. As a senior individual contributor, you will combine deep security expertise with hands-on software engineering to identify vulnerabilities, strengthen development workflows, and build practical security tooling. You will design secure software development practices, lead threat modeling and security reviews, and drive vulnerability remediation across complex APIs, SDKs, and cloud-based systems. Working closely with engineering teams and security leadership, you will integrate AI-powered tools into security testing and remediation while maintaining rigorous quality standards. This role offers substantial technical autonomy, opportunities to influence engineering practices across the organization, and the chance to solve challenging security problems at scale. You will help make security an integral part of product development rather than a separate compliance requirement. Accountabilities: As a Staff Application Security Engineer, you will serve as the technical foundation of the application security function, translating security strategy into effective engineering practices, tools, and measurable improvements. Your responsibilities will include: - Design and implement a secure software development lifecycle (SDLC), incorporating security requirements, design-time threat modeling, secure code reviews, and pre-release testing into existing engineering workflows.

- Own and improve application security tooling, including static and dynamic application security testing (SAST/DAST), software composition analysis (SCA), dependency scanning, secrets detection, and container and infrastructure-as-code scanning. - Integrate security tools into CI/CD pipelines, reduce false positives, establish clear vulnerability ownership and remediation service-level agreements (SLAs), and ensure findings lead to meaningful action. - Develop an AI-first security engineering approach using AI-assisted vulnerability triage, automated remediation, security review agents, and AI-augmented testing, with evidence-based controls governing what these tools can flag, block, or fix. - Build reusable security patterns, hardened libraries, and secure defaults for authentication, authorization, input validation, secrets management, and cryptographic operations. - Contribute directly to production codebases by implementing security fixes, developing security libraries, and building automation and CI integrations. - Lead threat modeling and architecture security reviews for new products, features, and significant technical changes across APIs, web and mobile SDKs, dashboards, and data pipelines. - Manage vulnerability identification, risk assessment, prioritization, and remediation for findings from security scanners, penetration tests, bug bounty reports, and customer disclosures. - Conduct hands-on security testing, including manual code review and exploitation testing for authentication and authorization weaknesses, API vulnerabilities, injection attacks, server-side request forgery (SSRF), business-logic flaws, and abuse scenarios. - Pay particular attention to adversarial threats involving fraud detection and bot mitigation, identifying weaknesses that could allow attackers to bypass or undermine platform protections. - Collaborate with penetration testing and compliance specialists to scope assessments, validate fixes, retest findings, and translate technical discoveries into actionable engineering work.