Leader, Application Security & Secure SDLC

Canada Life Group; Toronto; On-site; CAD 119,000 - 169,000; Full time

Benefits offered by this job

Career Development

Health & Wellness

Time Off

Financial Security

Rewards and Recognition

Emphasis on Community

Job summary

Canada Life in Toronto is seeking a Manager of Application Security to lead the organization's secure design, development, and deployment of applications. The role requires deep expertise in threat modeling, secure coding, SAST, DAST, and penetration testing, and collaboration with engineering, DevOps, and product teams to embed security into the SDLC.

You will mentor a team of security engineers, establish KPIs, manage ASPM, and provide executive reporting on vulnerabilities and remediation

Qualifications

• Bachelor’s degree in Computer Science, Information Security, or related field.
• 7+ years in application security or software development with security focus.
• 3+ years in a leadership or managerial role.
• Hands-on experience with threat modeling, SAST, DAST, and penetration testing.
• Proficiency with tools like Veracode, Checkmarx, Burp Suite, OWASP ZAP, and similar.
• Strong understanding of secure coding principles and vulnerability remediation.
• Familiarity with cloud security (AWS, Azure, GCP).
• Certifications (Preferred): CISSP, CSSLP, OSCP, GWAPT, or equivalent.

Responsibilities

• Define and execute the application security roadmap aligned with business objectives.
• Manage and mentor a team of application security engineers and analysts.
• Establish KPIs and metrics for security posture and program success.
• Experience implementing and managing Application Security Posture Management (ASPM).
• Integrate security controls into CI/CD pipelines.
• Oversee threat modeling for critical applications and architectures.
• Manage SAST and DAST tools.
• Coordinate and review penetration testing activities with vendors and internal stakeholders.
• Identify, assess, and prioritize application security risks.
• Ensure compliance with OWASP Top 10, NIST, ISO 27001, and regulatory requirements.
• Provide executive-level reporting on vulnerabilities and remediation progress.
• Partner with development teams to promote secure coding practices.
• Deliver training and awareness programs on application security.
• Act as a subject matter expert for application security across the organization.

Skills

Threat modeling

SAST

DAST

Penetration testing

Secure coding practices

Leadership

Mentoring

Cloud security (AWS/Azure/GCP)

Veracode/Checkmarx/ZAP familiarity

Education

Bachelor’s degree in Computer Science or Information Security

Tools

Veracode

Checkmarx

Burp Suite

OWASP ZAP

Job description

Canada Life in Toronto is seeking a Manager of Application Security to lead the organization's secure design, development, and deployment of applications. The role requires deep expertise in threat modeling, secure coding, SAST, DAST, and penetration testing, and collaboration with engineering, DevOps, and product teams to embed security into the SDLC.

You will mentor a team of security engineers, establish KPIs, manage ASPM, and provide executive reporting on vulnerabilities and remediation