Application Security Engineer — AI-Driven Secure DevOps

Capital Factory; Montreal (administrative region); Hybrid; CAD 90,000 - 130,000; Full time

Benefits offered by this job

Annual bonus program.

LTIP program, share in Workleap's long

RRSP + Family health insurance + tele/

Job summary

Workleap is building the security layer for how we write software, integrating SAST, DAST, SCA and secret scanning into GitHub Actions. We aim for agentic security review where agents perform the first pass on pull requests and escalate to humans when needed.

You will lead threat modeling on architectural changes, write tooling in Python, and strengthen Azure environments, collaborating with the AI SDLC team and LeapSec to ship secure software.

Qualifications

• Five or more years in application security, DevSecOps, or security focused software development.
• Deep working knowledge of web application security, OWASP Top 10, CWE Top 25.
• Proven experience building security automation into CI/CD pipelines, GitHub Actions preferred.
• Proficiency in Python for building tooling, not just scripting.
• Solid grasp of Azure services, infrastructure security, and deployment patterns.
• Ability to explain risk tradeoffs to engineers and execs.

Responsibilities

• Build the security guardrails for AI assisted and agentic development so speed and safety stop being a tradeoff.
• Move security review from human bottleneck to automated first pass with human judgment for ambiguity.
• Lead threat modeling on new features and architectural changes.
• Drive real remediation of application security vulnerabilities based on risk retirement, not tickets.
• Harden Azure environments and deployment patterns alongside Infrastructure SecOps.

Skills

Web application security

DevSecOps

CI/CD security automation

Python

GitHub Actions

Azure

Threat modeling

Tools

SAST tooling

DAST tooling

SCA tooling

Job description

Workleap is building the security layer for how we write software, integrating SAST, DAST, SCA and secret scanning into GitHub Actions. We aim for agentic security review where agents perform the first pass on pull requests and escalate to humans when needed.

You will lead threat modeling on architectural changes, write tooling in Python, and strengthen Azure environments, collaborating with the AI SDLC team and LeapSec to ship secure software.