Senior Application Security Analyst

Jobgether; Canada; Hybrid; CAD 140,000 - 175,000; Full time

Benefits offered by this job

Flexible work arrangements

Wellness subsidy

EFAP and mental health services

Retirement planning

Tuition reimbursement CAD 4,000

Paid SkillsWave days

Volunteer days

Employee referral program

Dog-friendly office spaces in Canada

Job summary

Jobgether represents a partner company in Canada seeking a Senior Application Security Analyst. You will strengthen application security across cloud platforms, endpoints, and infrastructure, delivering an effective program and driving remediation with engineering and operations teams.

The role blends hands-on testing with governance and audits, requiring experience with SAST/DAST/SCA, AWS/Azure, and security frameworks.

Qualifications

• Practical programming experience and proficiency in reviewing code across multiple programming languages.
• Hands-on experience implementing information security controls across endpoint, application, and infrastructure security domains.
• Familiarity with application security testing methodologies and tools, including SAST, DAST, and SCA.
• Hands-on experience with public cloud services such as AWS or Azure.
• Experience conducting vulnerability assessments and penetration tests.
• Experience with frameworks and standards such as ISO 27001, NIST 800-53, PCI-DSS, or PBMM.
• Familiarity with enterprise-grade Governance, Risk, and Compliance (GRC) tools.
• Experience assessing security control implementations in large enterprise, web-scale, and serverless environments.
• Proven ability to engage stakeholders and coordinate remediation of security findings.
• Experience supporting audits by providing security-related evidence.
• Strong communication skills; able to explain complex concepts to varied audiences.
• Ability to engage process owners and explain security controls related to business processes.
• Ability to work independently and synthesize information from multiple domains.
• Strong collaboration with engineering and operations teams.
• Red Team and Blue Team experience is a strong advantage.

Responsibilities

• Contribute to development and delivery of the application security program across the organization.
• Refine and implement application security practices for endpoints, applications, and infrastructure.
• Assess and address security risks with engineering and operations teams.
• Coordinate remediation efforts and periodic security assessments and audits.
• Review third-party security assessments and ensure findings are addressed.
• Track security risks and maintain audit-ready documentation.
• Engage stakeholders in remediation activities and provide security evidence for audits.
• Translate technical findings into practical security improvements for the program.
• Support governance, risk, and compliance activities across enterprise environments.

Skills

Code review across languages

Application security testing

Cloud security

Security governance & risk

Stakeholder communication

Threat modeling

Vulnerability management

Tools

SAST tools

DAST tools

SCA tools

AWS

Azure

GRC tools

Job description

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Application Security Analyst based in Canada.

Join a security-focused team dedicated to strengthening application security across cloud-based platforms, endpoints, and infrastructure. As a Senior Application Security Analyst, you will help refine and deliver an application security program that protects systems, reduces vulnerabilities, and supports secure engineering practices. You will collaborate with engineering and operational teams to identify emerging risks, assess security controls, and coordinate remediation efforts. The role combines hands-on technical expertise with stakeholder engagement, risk tracking, and audit support. You will work across complex enterprise, web-scale, and serverless environments while helping translate technical findings into practical security improvements. This is an opportunity to make a meaningful contribution to a secure digital learning ecosystem while continuing to develop your expertise in application and infrastructure security.

Accountabilities

You will contribute to the ongoing development and delivery of the application security program, working closely with technical and operational stakeholders to identify, evaluate, and address security risks.

• Help refine and implement application security practices, with a focus on endpoints, applications, and underlying infrastructure.
• Collaborate with operational teams to assess existing and emerging security risks and provide subject matter expertise.
• Conduct regular security scans and coordinate with relevant stakeholders to resolve identified issues.
• Triage third-party security assessments and follow up with stakeholders to ensure findings are addressed.
• Monitor and track security risks, findings, and associated documentation throughout their lifecycle.
• Support internal teams during security assessments, reviews, and audits.
• Review independent third-party reports from vendors, suppliers, and partners to verify alignment with the application security program.
• Engage stakeholders in remediation activities and help ensure security findings are resolved effectively.
• Generate and organize security-related evidence to support audit exercises and demonstrate the implementation of security controls.

Requirements

You bring practical application security experience, strong technical knowledge, and the ability to work independently while communicating effectively with stakeholders across engineering and operations.

• Practical programming experience and proficiency in reviewing code across multiple programming languages.
• Hands-on experience implementing information security controls across endpoint, application, and infrastructure security domains.
• Familiarity with application security testing methodologies and tools, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA).
• Hands-on experience with public cloud services such as AWS or Azure.
• Experience conducting vulnerability assessments and penetration tests.
• Experience working with security controls based on frameworks and standards such as ISO 27001, NIST 800-53, PCI-DSS, or PBMM.
• Familiarity with enterprise-grade Governance, Risk, and Compliance (GRC) tools.
• Experience assessing security control implementations in large enterprise, web-scale, and serverless environments.
• Proven ability to engage stakeholders and coordinate the remediation of security-related findings.
• Experience supporting audits by preparing and providing security-related evidence.
• Strong communication skills, including the ability to explain complex technical concepts clearly to stakeholders with different levels of technical expertise.
• Ability to engage process owners and explain the security controls associated with business and operational processes.
• Ability to work independently, learn quickly, and synthesize information from different domains and sources.
• Strong collaboration skills and the ability to work effectively with a broad range of engineering and operational teams.
• Red Team and Blue Team experience is a strong advantage.

Benefits

• Base salary: CAD 140,000-175,000 per year, depending on relevant knowledge, skills, education, training, experience, and geographic market factors.
• Potential additional compensation through variable incentives and equity grants.
• Flexible work arrangements.
• Competitive employee benefits package.
• Wellness subsidy and wellness reimbursement.
• Access to mental health services, an Employee and Family Assistance Program (EFAP), financial planning resources, and other wellbeing support.
• Retirement planning support.
• Home internet reimbursement.
• Learning and professional development opportunities.
• Tuition reimbursement of up to CAD 4,000 for continuing education through the SkillsWave Program.
• Two paid days off for SkillsWave-related activities, such as examinations or final assignments.
• Two paid volunteer days.
• Employee referral program.
• Employee recognition initiatives and social events.
• Dog-friendly office spaces at designated offices in Kitchener, Winnipeg, Vancouver, and Melbourne.
• An inclusive workplace that values diverse backgrounds, experiences, and perspectives.
• Accessibility accommodations during the recruitment process, available upon request.

How Jobgether works

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Data Privacy Notice

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1