Application Security Engineer

Thumbtack; Canada; Remote; CAD 120,000 - 180,000; Full time

Benefits offered by this job

Health insurance

Parental leave

Remote work stipend

Wellness programs

Camp Thumbtack

Job summary

Thumbtack’s Security Engineering team focuses on enabling innovation at scale by embedding security into systems, platforms, and developer workflows from the start. You will own and deliver application security work within defined projects, collaborating with product and engineering teams to guide architectural decisions and improve security posture as Thumbtack scales.

We value practical risk-informed improvements, clear communication, and a growth mindset.

Qualifications

• 4+ years in software engineering and/or application security.
• Clear written and verbal communication skills.
• Growth mindset and eagerness to learn from senior engineers.
• Experience with threat modeling and secure design patterns.
• Strong understanding of OWASP Top 10 and secure coding practices.

Responsibilities

• Own and deliver application security work within defined projects or domains.
• Contribute to cross-functional security initiatives with engineering and product teams.
• Identify, prioritize, and remediate security risks in partnership with developers.
• Apply secure-by-default patterns and approved architectures.
• Participate in security reviews, threat modeling, and post-incident analysis.

Skills

4+ years exp

Strong comms

Growth mindset

Threat modeling

OWASP Top 10

Tools

Secrets management

Job description

• The Security Engineering team at Thumbtack is focused on enabling innovation at scale by making the secure path the easiest path. We believe strong security is not a blocker to velocity, but a force multiplier when it is designed into systems, platforms, and developer workflows from the start
• We partner closely with Product, Engineering, Platform, and Data teams to shape system design, guide architectural decisions, and evolve Thumbtack’s security posture as the company scales. Through collaboration, automation, and thoughtful tradeoffs, we help ensure Thumbtack can ship fast, innovate boldly, and maintain customer trust
• As Thumbtack scales and increasingly incorporates AI-powered features into our products and internal systems, security must evolve without slowing innovation. The number of services, deployment patterns, and data flows continues to grow, and traditional approaches that rely heavily on manual reviews or after-the-fact controls do not scale to meet this need
• Instead, the challenge is to design security into the system itself. This means building secure defaults, paved paths, and reusable building blocks that product and engineering teams can adopt with minimal friction. By embedding security directly into architectures, tooling, and infrastructure, we reduce cognitive load on engineers and enable teams to move quickly and confidently while meaningfully lowering risk
• Own and deliver application security work within defined projects or domains. Contribute to cross-functional security initiatives, executing clearly scoped pieces of larger efforts
• Identify, prioritize, and help remediate application security risks in partnership with engineering teams
• Apply secure-by-default patterns and approved architectures when designing or reviewing systems
• Partner with product and engineering teams to assess risk and recommend practical, risk-informed security improvements. Participate in application security design reviews and threat modeling for new and existing systems
• Write code, reviews, and documentation to address vulnerabilities and reduce recurring classes of issues
• Participate in security incident response and contribute to post-incident analysis and remediation

Benefits

• Parental leave
• Health insurance
• Community matters | Sure, our ways of connecting have changed. But we haven’t missed a beat, from virtual concerts to "TTversary" celebrations to weekly catch-ups
• Always be improving | We bring out the best in our colleagues — and our product — by pushing each beyond what we believe we’re capable of. We give honest feedback, even when it’s hard
• Wellness is a way of life | We promote balance with generous PTO and company-wide holidays — and find our centers every Wellness Wednesday with yoga featuring a Thumbtack pro
• A worthy mission | In a world where tech is often seen as eroding good jobs, we’re helping small business owners thrive. Our product makes entrepreneurship accessible to everyone
• Driven by our values | Our values are the compass by which we make all our decisions. Each one matters: Lead with why, Make it count, Own it, Choose teamwork, and Say what you mean
• Plus, amazing benefits | All the benefits you’d expect, plus a few more: generous parental and fertility benefits, $1800 for Thumbtack services per year and a $1200 remote work stipend
• Virtual-first working model coupled with quarterly in-person events and Camp Thumbtack
• 20+ company-wide holidays including two week-long shutdowns
• Libraries (collaborative workspaces) in San Francisco, Salt Lake City, Toronto, and Manila
• Cell phone and WiFi reimbursements
• Subscriptions and Employee Assistance Program for mental health and well-being

4+ years of experience in software engineering and/or application securityClear written and verbal communication skills, including the ability to explain security issues to engineers with varying levels of security expertiseA growth mindset and interest in learning from more senior engineers and expanding depth in both application and cloud infrastructure security over timePractical experience with application security techniques such as threat modeling, secure design patterns, authentication and authorization, secrets management, and vulnerability remediation. Strong understanding of secure coding practices and common application security risks (e.g., OWASP Top 10)Strong sense of ownership over assigned work, with the ability to execute independently and follow throughAbility to assess security risks and break down complex problems, reason about tradeoffs, make sound recommendations, and deliver practical, impactful solutions with guidance when needed