Senior AppSec Research Engineer

CommIT; Toronto; On-site; CAD 150,000 - 190,000; Full time

Job summary

CommIT in Toronto seeks a senior, hands-on Application Security Researcher to push modern AppSec forward—collaborating with engineers, researchers, and AI/data scientists on next‑gen detection and autonomous pen-testing capabilities.

This build‑and‑break role goes beyond a typical AppSec position, requiring production‑quality code, strong vulnerability insight, and the ability to explain complex attack paths to product teams.

Qualifications

• 5+ years hands-on in offensive security, vulnerability research, or application security.
• Deep understanding of web application and API vulnerabilities, including business-logic flaws and multi-step attack chains
• Strong coding in Python, Go, or similar, with production-quality code shipped
• Experience building or tuning detection logic (SAST, DAST, SCA, secrets, or custom rule engines) and reducing false positives
• Solid grasp of modern stacks: CI/CD pipelines, containers, Kubernetes, and at least one major cloud provider
• Hands-on use of LLMs / AI models for security tasks, with the judgment to measure where they help and where they fail
• Comfort with large datasets (SQL, BigQuery, or similar) to drive research and measure detection accuracy
• Takes research ideas from prototype to production with minimal guidance
• Clear written communication — can explain a complex attack path to engineers and product managers
• M.Sc. in Computer Science, Cyber Security, or a related field

Responsibilities

• Lead development of next-generation AppSec detection and autonomous testing capabilities.
• Collaborate with engineers, researchers and AI/data scientists to push security research forward.

Skills

Offensive security

Web/API vulnerabilities

Python

Go

Detection logic

CI/CD

Containers/Kubernetes

Cloud providers

LLMs/AI for security

Large datasets

Research to production

Written communication

Education

M.Sc. in Computer Science/Cyber Security

Job description

CommIT in Toronto seeks a senior, hands-on Application Security Researcher to push modern AppSec forward—collaborating with engineers, researchers, and AI/data scientists on next‑gen detection and autonomous pen-testing capabilities.

This build‑and‑break role goes beyond a typical AppSec position, requiring production‑quality code, strong vulnerability insight, and the ability to explain complex attack paths to product teams.