Head of Application Security – Strategy & Secure Coding

Beacon Software; Toronto; On-site; CAD 120,000 - 180,000; Full time

Job summary

Beacon Software seeks its first dedicated application security engineer to set product security strategy and build the program. You will embed with engineering teams across Beacon and portfolio companies, defining the technical roadmap for product security as the organization grows.

You will own threat modeling, secure design reviews, vulnerability management, and AI security across diverse stacks. This role requires shipping production fixes and mature security tooling to sustain multi‑team

Qualifications

• Experience securing web and API functions across cloud environments.
• Ability to set standards across multiple codebases and teams.
• Track record of shipping production fixes and security tooling.

Responsibilities

• Lead threat modeling and security architecture reviews for new work.
• Own product security reviews for acquired codebases and cloud environments.
• Perform secure code reviews and drive remediation with teams.
• Assess AI features for security risks across products.
• Own end‑to‑end vulnerability management and reporting.
• Build CI/CD security tooling and automation for a multi‑team portfolio.
• Write secure coding standards and developer training.
• Serve as security expert during incidents and postmortems.
• Partner with GRC to provide audit evidence and security reviews.

Skills

Web security

API security

Identity access design

Cryptography

Cloud security

Container security

Tools

SAST

DAST

SCA

Secrets scanning

Job description

Beacon Software seeks its first dedicated application security engineer to set product security strategy and build the program. You will embed with engineering teams across Beacon and portfolio companies, defining the technical roadmap for product security as the organization grows.

You will own threat modeling, secure design reviews, vulnerability management, and AI security across diverse stacks. This role requires shipping production fixes and mature security tooling to sustain multi‑team