AppSec Engineer: Secure by Design & CI/CD

COFOMO; Lévis; On-site; CAD 90,000 - 130,000; Full time

Job summary

COFOMO seeks a security-focused software engineer to define and evolve security development standards and promote secure by design.

You will drive internal security, identify vulnerabilities, and collaborate with DevOps to embed security into CI/CD. Expertise in AppSec, OWASP, SAST/DAST/SCA, Kubernetes, SonarQube, Wiz, and WSL is required, plus AI security interest and cross-team influence.

Qualifications

• Solid background in software development with Java, .NET, JavaScript, Python or equivalent technologies.
• Expertise in application security (AppSec).
• Master OWASP vulnerabilities and secure development best practices.
• Experience with CI/CD pipelines and AppSec tools such as SAST, DAST, and SCA.
• Know Kubernetes, SonarQube, Wiz and WSL tools.
• Interest in security issues related to AI.
• Ability to influence and collaborate in a matrix environment.
• Excellent communication and extension skills.
• Adopt a solution-oriented approach and continuous improvement.

Responsibilities

• Define and evolve security development standards.
• Ensure the security of internal frameworks.
• Identify vulnerabilities and recommend appropriate fixes.
• Promote secure by design and shift left security.
• Act as a reference in application security for teams.
• Participate in the creation of common patterns, guides and tools.
• Collaborate with DevOps teams to integrate security into CI/CD pipelines.
• Implement tools to detect, monitor, and remediate vulnerabilities.

Skills

Software development

Secure coding

CI/CD experience

AppSec

Leadership influence

Tools

SAST

DAST

SCA

Kubernetes

SonarQube

Wiz

WSL

Job description

COFOMO seeks a security-focused software engineer to define and evolve security development standards and promote secure by design.

You will drive internal security, identify vulnerabilities, and collaborate with DevOps to embed security into CI/CD. Expertise in AppSec, OWASP, SAST/DAST/SCA, Kubernetes, SonarQube, Wiz, and WSL is required, plus AI security interest and cross-team influence.