Applied Security Engineer (DevSecOps & AppSec)

Colonial Group; Toronto; On-site; CAD 115,000 - 130,000; Full time

Job summary

QFG is seeking a Security Engineer to join our DevSecOps team. You will dive into how applications work, review source code for weaknesses, model threats, and verify fixes with developers to reduce exploitable flaws.

The role demands hands-on security testing, experience with SAST/DAST, and the ability to work independently across complex systems, including cloud, containers, and IaC. A strong coding background is essential.

Qualifications

• Bachelor's degree in Computer Science, Software Engineering, Cybersecurity, or a related technical field.
• Hands-on application security with expertise in code review and vulnerability testing.
• Proficient in Python or Bash for automation and test scripting.
• Strong debugging and problem-solving skills with ability to work across teams.

Responsibilities

• Secure Code Review of application source code and APIs.
• Threat Modeling and Secure Design for new features.
• Manual security testing of web applications and APIs.
• Vulnerability investigation and remediation with regression tests.
• Security automation in CI/CD and SBOM validation.
• Developer collaboration to remediate findings.
• AI application security assessment for prompt injection and data exposure.

Education

Bachelor's degree in Computer Science, Software Engineering, Cybersecurity, or related field

Job description

QFG is seeking a Security Engineer to join our DevSecOps team. You will dive into how applications work, review source code for weaknesses, model threats, and verify fixes with developers to reduce exploitable flaws.

The role demands hands-on security testing, experience with SAST/DAST, and the ability to work independently across complex systems, including cloud, containers, and IaC. A strong coding background is essential.