Lead Application Security Engineer — Remote

The French Sourcer; Toronto; Remote; CAD 308,000 - 448,000; Full time

Benefits offered by this job

Competitive equity

Job summary

The French Sourcer is seeking an experienced Lead Application Security Engineer to own end-to-end security as the first dedicated security hire.

This remote Canada-based role reports to the VP of Engineering and sits at the core of securing a rapidly growing platform handling customer data across regions.

Qualifications

• Demonstrated background as a backend software engineer with production-grade APIs and distributed systems.
• 6+ years in security engineering with strong distributed systems knowledge.
• Experience as an early security hire (1–3 roles) at a SaaS or data infra company, plus scale experience.
• Staff or Lead level today, with promotions over multi-year tenures.

Responsibilities

• Own application security end to end as the first dedicated security hire.
• Work primarily in the codebase (TypeScript/Go), shipping security fixes yourself.
• Threat modelling for new products and major redesigns early in the lifecycle.
• Design sub-tenant access control for multi-brand customers within the same account.
• Improve rate limiting, abuse detection, and granular access control on APIs.

Skills

Backend software engineer

Security engineering

Early security hire

Staff or Lead level

Multi-tenant security

Cloud/multi-region security

Education

Bachelor's degree in CS/Math/Physics

Tools

AWS

Azure

GCP

Job description

Lead Application Security Engineer — Remote (Canada)
Remote, Canada · Permanent · Remote
Compensation: $220,000 to $320,000 USD base, plus competitive equity

Be the first security engineer on a platform that moves customer data for hundreds of enterprises, where tenant isolation is a problem you solve in the code and the roadmap is yours to write.

What you'd actually work on

• Owning application security end to end as the first dedicated security hire, reporting to the VP of Engineering, while the engineering team roughly doubles in size


• Spending most of your week in the codebase, reading and writing production TypeScript and Go, and shipping security fixes yourself


• Threat modeling new products and major redesigns early, while design choices are still cheap to change, and hardening them before they reach customers


• Designing sub-tenant access control for multi-team and multi-brand customers who need different levels of access to configuration and data inside the same account


• Improving rate limiting, abuse detection and the granularity of access control on internet-facing APIs that serve customer data at high volume


• Extending a multi-region, multi-cloud backend into new regions so global customers can meet their data residency requirements, with security designed into each launch


• Building your own roadmap: looking at the architecture, finding the highest-leverage problems and going after them, with the autonomy that comes with being the first person in the role

Where it gets technically interesting

• Multi-tenant isolation on a system that runs very large volumes of data jobs every day and ingests a high-throughput stream of events. At that scale, a single isolation gap can expose one customer's data to another, so the margin for error is very small


• Compute isolation frameworks that you'll build and refine, balancing how strongly customer workloads are separated against cost and performance on a platform that keeps growing fast


• A backend spread across AWS, Azure and GCP that often operates against customer-owned cloud accounts, which means part of the trust boundary runs through infrastructure you don't control


• An authorization model for sub-tenants that has to be right early, because once hundreds of enterprise customers organize their teams and brands on top of it, changing it gets very expensive


• High-throughput public APIs where rate limiting and abuse detection must stop bad traffic without adding latency or blocking legitimate customers


• Privacy controls (PII handling, data residency, GDPR and CCPA) that are core engineering work here, since the product sits directly on top of customers' personal data

What we’re looking for

• A real background as a backend software engineer: you wrote production code (APIs, distributed systems, data pipelines) inside a product codebase before or alongside your move into security. The team cares much more about what you've built than about certifications


• 6+ years in security engineering with deep distributed systems knowledge, enough to understand what product teams are building and influence it from a place of trust


• Experience as an early security hire (first 1 to 3) at a SaaS or data infrastructure company, plus 2+ years at a venture-backed or high-growth company as it went through real scale


• Staff or Lead level today, reached through promotions over tenures of 2 years or more


• Hands-on experience securing multi-tenant platforms (tenant isolation, authorization models) and systems that span several clouds or regions


• A degree in Computer Science, Math, Physics or a similar field, and the ability to explain a design clearly and stay precise under deep technical questions


• Bonus: privacy-adjacent security work, having designed or secured data infrastructure as an early engineer, or experience at a security-focused company. Former managers who want to return to a fully hands‑on IC role are welcome

The company

A late‑stage B2B data and AI company, backed by top‑tier investors, whose platform helps businesses turn their customer data into personalized marketing, with a growing part of that work now driven by AI agents. Revenue and headcount have been growing fast year over year, and hundreds of companies rely on the platform in production. Several hundred people, fully remote, with an engineering culture that holds a very high bar for quality and simple, scalable software. This is the company's first dedicated security role: it reports to the VP of Engineering and works across every product team. Competitive equity and benefits. Remote within Canada.

Languages:

English (fluent, professional)