Application Security Specialist

Bank of Montreal; Toronto; On-site; CAD 92,000 - 172,000; Full time

Job summary

A leading company is seeking a Sr. Application Security Specialist responsible for enhancing application and cloud security. This role involves reviewing architectures, conducting security assessments, and ensuring compliance with industry standards. Candidates should have extensive experience in information security, penetration testing, and project management, with a strong ability to influence and communicate effectively.

Benefits

Health insurance

Tuition reimbursement

Accident and life insurance

Retirement savings plans

Qualifications

• Experience performing DAST testing and creating security reports.
• Competency in managing remediation across teams.
• Knowledge of network security components and cloud architecture.

Responsibilities

• Review and consult system architecture and application security.
• Perform audits and remediation activities.
• Establish relationships with stakeholders and provide security guidance.

Skills

DAST testing

penetration testing

communication

project management

information security standards

Education

6 years of full-time work experience in information security

Tools

SIEM

anti-malware products

AWS

MS Azure

Job description

Application Deadline:

07/10/2025

Address:

250 Yonge Street

Job Family Group:

Technology

The Sr. Application Security Specialist role is responsible for designing, evaluating, and supporting application security and cloud security capabilities in support of the security and compliance programs at AIR MILES. Individuals in this role possess well developed technical skills, a strong familiarity with network, system, and application architecture, and an understanding of the technical security landscape. These strengths are applied to a variety of activities, such as application security reviews, consulting on system architecture, and securing cloud environments at scale. Individuals in this role perform a variety of activities, encompassing application, cloud, and infrastructure security including establishing standards, participating in investigations, and providing guidance on aligning to industry best practices.

Responsibilities:

• Reviewing system and solution architecture
• Consulting with software developers and supporting improvements to application security
• Consult on risk assessments and work with stakeholders to implement measures to mitigate risk
• Perform audit/testing on infrastructure and application controls and work with stakeholders on remediation activities
• Actively work with third party service providers to lead and support any work performed
• Contribute to monthly Information security metrics for reporting
• Establish relationships with internal stakeholders, keep abreast of technology, bring emerging risks to management attention, and identify opportunities for improving existing security processes.
• Consult on Internal Security Policy and Baseline Standards

Qualifications

• Experience performing DAST testing on web applications, or experience with penetration testing of applications or network environments.
• Experience creating security assessment reports and presenting them to clients.
• Demonstrated competency in project participation in a cross-functional environment and experience in managing remediation activities across the enterprise.
• Communication skills especially in areas where diplomacy is needed to help ensure that new policies and procedures gain the support they need to be adopted by the enterprise and management.
• At least 6 years of full-time work experience in information security and/or related functions
• Familiarity with Information security standards and IT frameworks
• Knowledge of Security Governance, Risk & Compliance and security audit practices.
• Experience in multiple security domains (e.g. Access control, application and system development, operations security, network, BCP/DR, etc.)
• Sound knowledge of network security and network security components such as firewalls, routers, intrusion detection and other products such as SIEM and anti-malware products.
• Strong knowledge of cloud architecture security and deployment of security controls in a cloud environment (e.g. MS Azure, AWS, etc.).
• Hands-on experience building and operating in a cloud environment.
• Thorough understanding of web application architecture, single sign on technologies, and the HTTP/HTTPS protocols.

Certifications

While not required, candidates with relevant certifications, such as OSCP, OSCE, GWAPT, or similar are encouraged to apply. We value hands-on experience and demonstrable skills equally.

Salary:

$92,400.00 - $171,600.00

Pay Type:

Salaried

The above represents AIR MILES’ pay range and type.

Salaries will vary based on factors such as location, skills, experience, education, and qualifications for the role, and may include a commission structure. Salaries for part-time roles will be pro-rated based on number of hours regularly worked. For commission roles, the salary listed above represents AIR MILES’ expected target for the first year in this position.

AIR MILES’ total compensation package will vary based on the pay type of the position and may include performance-based incentives, discretionary bonuses, as well as other perks and rewards. AIR MILES also offers health insurance, tuition reimbursement, accident and life insurance, and retirement savings plans. To view more details of our benefits, please visit: https://jobs.bmo.com/global/en/Total-Rewards

About Us

The AIR MILES Reward Program is one of Canada’s most recognized loyalty programs, with over 10 million active collector accounts, representing more than half of all Canadian households. AIR MILES collectors earn Reward Miles at more than 300 leading Canadian, global and online brands and at thousands of retail and service locations across the country. AIR MILES is a wholly-owned subsidiary of the Bank of Montreal (BMO). BMO is Canada’s oldest bank and the 8th largest in North America with more than 12 million customers globally.

As a member of the AIR MILES team you are valued, respected and heard, and you have more ways to grow and make an impact. We strive to help you make an impact from day one – for yourself and our customers. We’ll support you with the tools and resources you need to reach new milestones, as you help our customers reach theirs. From in-depth training and coaching, to manager support and network-building opportunities, we’ll help you gain valuable experience, and broaden your skillset.

To find out more visit us at https://bmo.wd3.myworkdayjobs.com/en-US/External-AIR-MILES.

AIR MILES is committed to an inclusive, equitable and accessible workplace. By learning from each other’s differences, we gain strength through our people and our perspectives. Accommodations are available on request for candidates taking part in all aspects of the selection process. To request accommodation, please contact your recruiter.

Note to Recruiters: AIR MILES does not accept unsolicited resumes from any source other than directly from a candidate. Any unsolicited resumes sent to AIR MILES, directly or indirectly, will be considered AIR MILES property. AIR MILES will not pay a fee for any placement resulting from the receipt of an unsolicited resume. A recruiting agency must first have a valid, written and fully executed agency agreement contract for service to submit resumes.