Application Security Engineer

tmx; Toronto; On-site; CAD 90,000 - 130,000; Full time

Job summary

TMX is seeking an Application Security Engineer to design, implement, and govern our security program across core product suites. You will lead secure design reviews, perform advanced vulnerability testing, and partner with development teams to embed secure coding practices.

In this role, you will maintain security KPIs, stay ahead of emerging threats, and help shape threat modeling, CI/CD security guardrails, and cloud security strategies within a fast-paced financial tech environment in

Qualifications

• 3+ years of hands-on application security engineering.
• Experience with OWASP Top 10, CWE Top 25 and remediation of vulnerabilities.
• Knowledge of secure development lifecycle and modern development methodologies.
• Understanding of CI/CD environments and secure DevOps practices.
• Experience with cloud security and container security (CNAPP, Docker/Kubernetes, AWS).
• Ability to articulate vulnerabilities to technical and non-technical stakeholders.

Responsibilities

• Lead and execute ongoing application security testing across product suites.
• Collaborate with Dev and Product teams to design secure architectures.
• Perform code reviews to identify security flaws and attack vectors.
• Provide guidance on secure coding practices and risk-based prioritization.
• Maintain KPI reports on the application security posture.

Skills

Penetration testing

Secure code reviews

CI/CD security

Cloud security

Cryptographic protocols

Security tooling

Tools

Burp Suite Professional

Chrome DevTools

SQLmap

Wireshark

SAST/DAST tools

Job description

Venture outside the ordinary - TMX Careers

The TMX group of companies includes leading global exchanges such as the Toronto Stock Exchange, Montreal Exchange, and numerous innovative organizations enhancing capital markets. United as a global team, we're connecting cross-functionally, traversing industries and geographies, moving opportunity into action, advancing global economic growth, and propelling progress. Through a rich exchange of ideas, meaningful collaboration, and a nimble operating model, we're powering some of the nation's most critical systems, fueling capital formation and innovation, bringing increased opportunity to business visionaries, product ingenuity to consumers, and career exploration to our team.

Ready to be part of the action?

An Application Security Engineer will be responsible for implementing the design and execution of our Application Security Programme including architecting secure design principles, identifying complex vulnerabilities, conducting security assessments and working closely with development teams to promote secure coding practices.

Primary Responsibilities

• Lead, and execute ongoing application security testing against the organisation's product suite.
• Collaborate with development and product teams to design secure application architectures that meet business requirements while minimizing security risks.
• Perform thorough code reviews to identify security flaws, coding errors and potential attack vectors in application codebases.
• Articulate complex technical vulnerabilities in a clear, actionable manner to key stakeholders, including development teams, product owners, and executive leadership.
• Provide guidance on the application vulnerability management lifecycle, tracking vulnerabilities according to our risk management process and ensuring development teams successfully resolve identified issues.
• Provide guidance to developers and other team members on secure coding practices, security best practices and latest security trends.
• Maintain Key Performance Indicator (KPI) reports and metrics summarizing the organization's application security posture.
• Stay up to date with the latest security tools and technologies & evaluate their effectiveness in streamlining application security objectives.
• Ensure applications adhere to relevant security standards, regulations & industry best practices.
• Identify advanced application-level security vulnerabilities in our products using modern penetration testing techniques and threat modeling.
• Create and maintain detailed documentation related to application security architectures, design decisions and security guidelines.

Additional Responsibilities

• Cultivate strategic relationships with development teams and engineering leadership to ensure smooth execution and cultural adoption of the security testing programme.
• Partner with development and DevOps teams to architect and automate security tests and guardrails into continuous integration/continuous deployment (CI/CD) pipelines.
• Maintain deep expertise in emerging technologies, novel attack vectors, and evolving vulnerability landscapes.

Required Skills

• Proven hands-on experience (ideally 3+ years) of performing application security engineering; penetration tests and security code reviews.
• Deep, authoritative knowledge of key application security vulnerabilities (OWASP Top 10, CWE Top 25) and how to remediate them.
• Experience with secure coding practices and secure development lifecycle. Knowledge of modern development methodologies.
• Understanding of common CI/CD environments.
• Strong understanding of web application, cloud security and microservices architectures.
• Advanced knowledge of key application layer protocols and data formats (HTTP, WebSockets, SQL, JSON, Protobufs).
• Strong proficiency in common application development languages and frameworks, with the ability to perform secure code review (C++, C#, Python or JavaScript).
• Deep working knowledge of cryptographic protocols, implementations, and best practices (TLS).
• Experience with interpreting vulnerability scanning and penetration testing results.
• Previous knowledge in conducting penetration testing as well as penetration testing methodologies is a plus.
• Knowledge of cloud security and cloud architecture (CNAPP, Docker/Kubernetes, AWS Lambda).
• Working understanding of network protocols, firewall configurations and common web protocols.
• Expert-level use of common industry tools (Burp Suite Professional, Chrome/FF dev tools, SQLmap, Wireshark, CSPM and SAST/DAST tools).
• Excellent written and verbal communication skills-able to express complex technical issues in a concise, accurate, and business-impact context.
• Strong pragmatism-expert at identifying strategic compromises that balance security risk with business and engineering delivery needs.

Desirable Qualifications

• SANS GXPN (GIAC Exploit Researcher and Advanced Penetration Tester)
• OSCP / OSWE (Offensive Security Certified Professional / Web Expert)
• Relevant certifica