Lead Application Security Engineer

Elastify Inc.; Toronto; Hybrid; CAD 100,000 - 150,000; Full time

Job summary

A leading company in IT Services and Consulting is seeking a Lead/Manager of Application Security in downtown Toronto. This hybrid role requires extensive experience in software development and cybersecurity, with a focus on application vulnerability remediation and secure coding practices. Ideal candidates will have a strong technical background and relevant certifications. Join a dynamic team and contribute to enhancing application security in a fast-paced environment.

Qualifications

• 10+ years of experience in software development and cybersecurity engineering.
• Proficiency in scripting languages (Python, PowerShell) and programming languages (Java, C#, C++, SQL).
• Extensive experience with application security testing tools (SAST, DAST, IAST, SCA).

Responsibilities

• Lead application security initiatives and vulnerability remediation.
• Ensure secure coding practices and insider threat detection.
• Oversee application security testing and security automation.

Skills

Application vulnerability remediation

Container security

Secure coding practices

Insider threat detection

Scripting languages

Application security testing tools

Security automation tools

Architectural knowledge

Secure software development lifecycle

Job description

Elastify is looking for a Lead/Manager of Application Security who remains hands-on for a permanent role in downtown Toronto. The position is hybrid. Please apply for more details.

Must-have:

1. 10+ years of experience in software development and cybersecurity engineering roles, with significant hands-on expertise in application vulnerability remediation, container security, secure coding practices, and insider threat detection.
2. Proficiency in scripting languages (e.g., Python, PowerShell) and familiarity with multiple programming languages (e.g., Java, C#, C++, SQL) for software development and vulnerability remediation.
3. Extensive hands-on experience with application security testing tools (SAST, DAST, IAST, SCA) and direct remediation activities.
4. Technical expertise with container security (Docker, Kubernetes), infrastructure-as-code (IaC) security (e.g., Terraform), vulnerability remediation, insider threat detection, and security automation tools.
5. Strong architectural knowledge, comprehensive understanding of secure software development lifecycle (SSDLC) practices, and familiarity with OWASP Top 10, SANS 25, and threat modeling methodologies.

Nice-to-have:

1. Relevant security certifications (CSSLP, GWAPT, OSCP, CISSP, or equivalent).
2. Experience in financial services or highly regulated industries.

Seniority level

• Mid-Senior level

Employment type

• Full-time

Job function

• Information Technology

Industries

• IT Services and IT Consulting