Senior AppSec Engineer — Secure Software & Threat Modeling

Dragonfly Logistics Lab Inc.; Montreal; On-site; CAD 120,000 - 160,000; Full time

Benefits offered by this job

On-site gym

Lunch provided

Group insurance

RRSP plan

Care & Well-being

Transit reimbursement

Employee Assistance Program

Job summary

Intelcom | Dragonfly is seeking a seasoned Application Security expert to define and enforce secure software development practices across our ecosystems. You will lead threat modeling, security testing, and guardrail development across CI/CD pipelines, cloud workloads, APIs, and containerized environments.

Collaborate with engineering, product, and cybersecurity teams to implement robust security features, patterns, and documentation.

Qualifications

• Broad knowledge of application security, secure software development, application testing methodologies, secure coding, and secure product design.
• Strong understanding of modern application architectures, APIs, web services, and associated security risks.
• Strong knowledge of threat modeling and secure design methodologies.
• Working knowledge of cloud security concepts and controls in Azure and/or AWS as they relate to application workloads.
• Working knowledge of security automation with scripting languages such as Python and Bash.
• Knowledge of one or more development languages such as Java, Node.js, C#, or .NET.
• Knowledge of information security risk, security frameworks, regulatory requirements, and industry best practices.
• Strong problem-solving, communication, stakeholder management, and time-management skills.
• Hands-on experience with application security testing, implementation of secrets management solutions and CI/CD, container, API, serverless security controls.

Responsibilities

• Act as a subject matter expert on secure software development practices.
• Define, implement, and continuously improve application security controls, standards, guardrails, and baseline configurations.
• Assess effectiveness of controls across CI/CD pipelines and application platforms (web, mobile, APIs, containers, desktop apps, and COTS).
• Lead threat modeling and secure design activities and provide remediation recommendations.
• Own and improve application security services and tooling, including selection, onboarding, configuration, optimization, testing, and lifecycle management.
• Lead application security testing activities (manual, automated) and remediation.
• Drive security automation and repeatable controls throughout the software development lifecycle.
• Partner with engineering, product, platform, architecture, and cybersecurity teams to design and implement security features.
• Create and maintain application security guidance, secure patterns, training materials, and documentation.
• Host training sessions, knowledge-sharing forums, and drive application security community of practice.
• Provide training on API, web, mobile and application security principles and risks.
• Make decisions on complex issues and provide direction aligned with best practices.
• Deliver outcomes with autonomy and practical recommendations on complex security matters.

Skills

Application security

Threat modeling

CI/CD security

Cloud security (Azure/AWS)

Python/Bash scripting

Secure coding

Communication & stakeholder mgmt

Security testing (manual/ automated)

Education

Degree in computer science or related field

Security certifications (CISSP/CSSLP/CEH/OSCP/GIAC)

Cloud security certifications asset

Tools

Python

Bash

Azure

AWS

CI/CD tooling

Job description

Intelcom | Dragonfly is seeking a seasoned Application Security expert to define and enforce secure software development practices across our ecosystems. You will lead threat modeling, security testing, and guardrail development across CI/CD pipelines, cloud workloads, APIs, and containerized environments.

Collaborate with engineering, product, and cybersecurity teams to implement robust security features, patterns, and documentation.