Senior App Security Engineer — Remote & AI‑Ready

JobCubby; Quebec; Hybrid; CAD 231,000 - 319,000; Full time

Benefits offered by this job

Competitive compensation

401(k) with company match

Employee stock purchase plan (ESPP)

Comprehensive health coverage

Wellness & productivity allowances

Job summary

Upstart is seeking a Senior Application Security Engineer to lead security projects across products and engineering. You’ll partner with product, platform, data, infrastructure, and engineering teams to identify security risks, review designs, build preventative controls, and drive durable improvements that raise the security bar across the team and its partners.

Remote role available with U.S. or Canadian teams; base salary range is $166,900–$230,900 USD, plus bonus opportunities and equity.

Qualifications

• Minimum 5+ years in security or software engineering with 2+ years in application or product security.
• Experience leading security projects with multiple contributors or partner teams.
• Experience threat modeling and security architecture reviews for complex production apps.
• Proficient in production software development in Java, Python, Ruby, Go, or equivalent.
• Experience implementing app security controls across the SDLC: API security, secure coding, SAST/DAST/CI/CD security, secrets management.

Responsibilities

• Lead application security projects end-to-end across products and teams.
• Conduct threat modeling and security reviews for complex applications, APIs, and AI/ML systems.
• Design and implement secure-by-default controls across the SDLC with automated testing and CI/CD safeguards.
• Identify systemic vulnerabilities and drive durable remediation with engineering teams.
• Build services and automation to improve vulnerability detection and reduce developer friction.
• Assess security of AI-enabled products, GenAI workflows, and data handling.

Skills

Security leadership

Threat modeling

Security architecture

Production software

Cloud security

Vulnerability remediation

Java

Python

Go

APIs security

SAST/DAST

CI/CD security

Job description

Upstart is seeking a Senior Application Security Engineer to lead security projects across products and engineering. You’ll partner with product, platform, data, infrastructure, and engineering teams to identify security risks, review designs, build preventative controls, and drive durable improvements that raise the security bar across the team and its partners.

Remote role available with U.S. or Canadian teams; base salary range is $166,900–$230,900 USD, plus bonus opportunities and equity.