Senior Specialist, Security Applications (AppSecOps)

Canada Mortgage and Housing Corporation (CMHC) Société canadienne d'hypothèques et de logement(SCHL); Ottawa; On-site; CAD 104,180 - 130,225; Full time

Benefits offered by this job

Defined benefit pension plan

Comprehensive group insurance plan

Support towards personal and professional growth

Job summary

Canada Mortgage and Housing Corporation (CMHC) is seeking a Bilingual Senior Specialist in Application Security. This role involves managing the enterprise Application Security program, ensuring compliance with security standards and regulations. Candidates should have strong application security skills, a degree in IT or related fields, and be fluent in both English and French.

As part of a hybrid working environment, you will focus on integrating security into the software development lifecycle while engaging with stakeholders across the organization.

Qualifications

• Minimum 7 years of progressive experience in application security.
• Experience in enterprise-level governance and DevSecOps integration.
• Strong communication skills in English and French.

Responsibilities

• Own the enterprise Application Security control framework.
• Define and govern mandatory SDLC/SSDLC security requirements.
• Establish security requirements within Agile and DevSecOps models.

Skills

Application Security

Secure Coding

Stakeholder Management

Bilingual (English/French)

Education

Undergraduate degree in Information Technology, Computer Science, or Cybersecurity

Tools

CI/CD Pipelines

Cloud Security

Job description

Job Requisition ID: 12213

Position Status: Permanent Full Time

Position Type: Hybrid

Office Location: Ottawa (ON); Montreal (QC)

Travel Requirement: Limited

Language Designation: Bilingual

Language Skill Levels (Read/Write/Speak): CBC

Security Requirement: Secret

Salary: Our salaries generally range from $ 104,180.28 to $ 130,225.36 and are based on qualifications and experience.

About CMHC

The work you do and the work we do together matters. We come to work every day with a common purpose: to contribute to a well-functioning housing system.

At CMHC, we hold ourselves accountable for our results and support our colleagues in their achievements. We thrive on collaboration, connecting across CMHC and involving the right people to get our work done. Our leadership style is guided by trust, where our leaders favour an adaptive approach based on the needs of their teams.

Join us and be part of a team that's committed to making a real difference and be part of something meaningful.

Benefits

• Annual Paid vacation.
• Annual individual performance incentive.
• Defined benefit pension plan.
• Comprehensive group insurance plan to support your well-being from day one.
• Support towards your personal and professional growth with training, mentorship and more.
• An inclusive workplace culture and environment.

About The Role

Join the Technology and Business Transformation team, in the Bilingual Senior Specialist, Application Security. You'll be responsible for the enterprise Application Security (AppSec) program, including the definition of mandatory controls, standards, and governance mechanisms that ensure applications and software services are designed, built, tested, and operated in alignment with organizational risk tolerance, security strategy, and regulatory obligations across the full SDLC/SSDLC.

What You’ll Do

• Owns the enterprise Application Security control framework, including policies, standards, and minimum control requirements for application design, development, testing, deployment, and runtime, ensuring alignment with enterprise architecture, cloud security posture, privacy obligations, and regulatory frameworks.
• Defines and governs mandatory SDLC/SSDLC security requirements and assurance activities, including secure design reviews, application security testing (SAST, DAST, SCA, IAST, penetration testing), secure configuration standards, and formal risk acceptance and exception processes with defined compensating controls and lifecycle management.
• Exercises enterprise-level accountability for application security risk posture, including identification, assessment, and communication of risks in business terms; provides authoritative guidance on control selection, vulnerability severity, remediation prioritization, and risk treatment strategies, including acceptance and compensating controls.
• Establishes and enforces security requirements within Agile and DevSecOps delivery models, including security gates and assurance expectations, ensuring consistent and measurable integration of security into software delivery without direct ownership of delivery execution.
• Acts as the senior authority and escalation point for complex vulnerabilities, design-level security risks, and disputed risk or exception decisions, providing binding guidance within delegated authority.
• Owns application security program assurance and performance management, including definition and monitoring of KRIs/KPIs, oversight of assurance quality (internal and third-party), and reporting of risk posture, systemic issues, and trends to senior management and governance bodies.
• Exercises delegated decision-making authority over minimum control requirements, vulnerability severity alignment, and treatment expectations, and recommends risk acceptance or policy exceptions, with escalation of decisions exceeding authority to formal governance bodies.

What You Should Have

• An undergraduate degree in Information Technology, Computer Science, Cybersecurity, or related field. an equivalent combination of education and progressively responsible experience.
• A minimum of 7 years of progressive experience in application security, including enterprise-level governance and DevSecOps integration.
• Demonstrated expertise in secure coding, application security testing, cloud-native architectures, CI/CD pipelines, and application of recognized frameworks (ISO, NIST, ITSG‑33).
• A proven ability to influence senior stakeholders and translate technical security risks into defensible, risk-based decisions within a complex or regulated environment.
• Strong communication and stakeholder management skills in both official languages (English and French), with proven experience operating in complex, cross functional environments.

It Would Be Great If You Also Had

• Experience working in large‑scale, complex, or regulated environments is an asset.
• Professional certifications (e.g., CISSP, CSSLP, GIAC).

Posting closing date: Note, the competition will remain active until filled.

Our Commitment to Diversity, Equity, and Inclusion

We’re committed to employment equity and encourage women, Indigenous Peoples, persons with disabilities, veterans and persons of all races, ethnicities, religions, abilities, sexual orientations, and gender identities and expressions to apply. We also welcome applications from non-Canadians who are eligible to work in Canada. CMHC is an inclusive workplace where diversity of thought – and of people – are recognized, valued, and considered essential to achieving our mission.