Senior AppSec Engineer: Secure by Design

Lightspeed Commerce; Calgary; On-site; CAD 110,000 - 160,000; Full time

Benefits offered by this job

Lightspeed equity scheme

Flexible paid time off

Health insurance

Job summary

Lightspeed Commerce is seeking a Senior Application Security Engineer to anchor the AppSec team as we shift toward developer-embedded security and Secure by Design. You will design, build, and scale advanced AppSec practices, collaborating with Vulnerability Operations to streamline triage and remediation.

You will embed security into feature design, architect threat models, and drive AI-driven automation across CI/CD pipelines, guiding developers through fixes and enabling secure coding across

Qualifications

• Hands-on AppSec, product security in cloud environments.
• Bachelor's degree or equivalent practical experience.
• Deep understanding of OWASP Top 10 and secure coding practices.
• Experience tuning SAST/DAST/SCA/Secrets/LLM pipelines in CI/CD.
• Experience with AI/LLM tools to automate security analyses.

Responsibilities

• Embed Secure by Design principles into feature designs and workflows.
• Architect threat models for features and infrastructure.
• Tune SAST, DAST, SCA, Secrets, and LLM scanner rules in CI/CD.
• Develop new AppSec processes and maintain legacy security controls.
• Drive AI-driven vulnerability triage and remediation.
• Provide hands-on fix guidance to developers.

Skills

AppSec experience

Threat modelling

CI/CD security

AI/LLM tooling

Secure coding

Education

Bachelor's degree in CS/Cybersecurity/SE

Tools

SAST

DAST

SCA

Secrets

LLM scanners

Job description

Lightspeed Commerce is seeking a Senior Application Security Engineer to anchor the AppSec team as we shift toward developer-embedded security and Secure by Design. You will design, build, and scale advanced AppSec practices, collaborating with Vulnerability Operations to streamline triage and remediation.

You will embed security into feature design, architect threat models, and drive AI-driven automation across CI/CD pipelines, guiding developers through fixes and enabling secure coding across