Senior Application Security Engineer

BioRender; Toronto; On-site; CAD 120,000 - 180,000; Full time

Job summary

BioRender is seeking a Senior Application Security Engineer to join our Security team. You will contribute directly to production code and infrastructure (Node.js/React/Python, AWS, Terraform, Cloudflare) while embedding secure-by-design practices across the engineering workflow.

You’ll lead threat modeling, secure SDLC, and CI/CD security integrations, and work with AI-native tooling to accelerate security tasks. Strong coding ability and hands-on security expertise are essential.

Qualifications

• Proven ability to write production-grade code (Node.js/React; Python a plus).
• Experience integrating SAST/DAST tools within CI/CD pipelines.
• Cloud security experience on AWS and infrastructure-as-code (Terraform).
• Threat modeling for new and existing systems; secure SDLC ownership.
• Understanding of cryptography, PKI, and TLS in practice.
• Fluency with AI development tools and agentic workflows to accelerate security work.

Responsibilities

• Contribute production-quality code to the app and infrastructure to ship fixes and hardening.
• Build and maintain security/CI/CD tooling for automation and secure defaults.
• Review RFCs/designs for security and pair with engineers to remediate at the source.
• Define secure-by-design patterns for authentication, authorization, and API security.
• Lead threat modeling and translate models into deployed controls.
• Own the Secure SDLC and CI/CD security integrations (SAST/DAST/SCA/secrets).
• Perform penetration testing and code reviews (Node.js/React) following OWASP guidelines.
• Drive remediation of vulnerabilities and manage the bug bounty program end-to-end.

Skills

Software engineering

AI tooling

Web security

SAST/DAST CI/CD

AWS & IaC

Threat modeling

Cryptography & TLS

Tools

Terraform

Cloudflare

AWS

Job description

At BioRender, we are on a mission to accelerate the world's ability to learn, discover, and communicate science - transforming how knowledge is shared and making science open, collaborative, and easily understandable by all.

We are shaping the future of science communication and are looking for talented individuals to help bring this vision to life!

BioRender is seeking a Senior Application Security Engineer to join our Security team - an engineer first, who contributes directly to the codebase rather than managing security from the sidelines. You'll help define how security is built into our engineering organization, contributing production code across our application (Node.js/React/Python) and infrastructure (Python, Terraform, AWS, Cloudflare) while shaping secure-by-design patterns, CI/CD automation, and engineering workflows that let the company move quickly and safely.

You'll work AI-natively, using AI coding assistants and agentic tooling to accelerate your own work while helping secure the AI-powered capabilities we're building. If you're excited by building developer-friendly security systems, solving meaningful engineering problems, and focusing on the threats that actually matter, we’d love to hear from you.

What You'll Do

Hands-on engineering & codebase contribution

• Contribute production-quality code directly to the application (Node.js/React) and infrastructure (Python, Terraform) – you ship fixes and hardening yourself, not just findings for others to action.
• Build and maintain security and CI/CD tooling for automation, keeping the secure path the default path.
• Act as a security reviewer on RFCs and design documents, and pair with engineers to resolve issues at the source.

Architecture, design & secure SSDLC

• Define secure-by-design patterns and drive standards for authentication, authorization, and API security.
• Lead threat modeling on new and existing systems and turn those models into shipped controls.
• Own and evolve the Secure SDLC and CI/CD security integration (SAST/DAST/SCA/secrets) - tuned for high signal and low noise.

AI-native security & automation

• Work AI-natively: use AI coding assistants and agentic tooling to accelerate code review, triage, and tooling development.
• Secure AI-integrated product features - reasoning about prompt injection, data leakage, and over-scoped tool, token, and data access.
• Automate recurring security work so the team scales through leverage, not headcount.

Web & product security (active defense)

• Perform penetration testing and code reviews (Node.js/React) using OWASP methodology.
• Drive identification and remediation of application security vulnerabilities (SAST/DAST/HackerOne).
• Own the bug bounty program end to end - issue evaluation, reproduction, and closing findings by shipping fixes.

What You Bring

• Demonstrable software engineering ability – you read code fluently, write production-quality code that engineers respect, and have contributed to real codebases (Node.js/React; Python a plus).
• Fluency using AI development tools (AI coding assistants, agentic workflows) to get the job done, and a clear-eyed view of the security risks they introduce.
• Expertise in web application security and secure-coding best practices, and the ability to review code and application findings.
• Experience integrating and maintaining SAST/DAST systems within CI/CD, and with Secure Software Development Life Cycles.
• Hands-on experience securing cloud workloads on AWS and comfort with infrastructure-as-code (Terraform or equivalent); familiarity with Cloudflare a plus.
• Threat-modeling experience and command of common code and network vulnerability types, their impact, and remediation.
• Applied knowledge of cryptography, PKI, and TLS and their practical implementation.

Nice To Have

• Experience hardening LLM-integrated or AI-powered features in production.
• Experience operating a bug bounty program (e.g. HackerOne).
• Contributions to SOC 2 control design and audit readiness from the engineering side.
• Relevant certifications (e.g. OSCP, OSWE, AWS Security Specialty) - valued, but not a substitute for engineering ability.

Why join us?

• We are mission-driven