Remote Application Security Engineer — Secure SDLC Champion

VGS; United States; Hybrid; CAD 250,000 - 328,000; Full time

Benefits offered by this job

Remote opportunities

Flexible working hours

Office lunches

Internet stipend

Learning stipend

Early equity

Job summary

VGS is hiring an Application Security Engineer to partner across Security and Engineering, shaping a developer-friendly Secure SDLC and embedding security into CI/CD.

You will automate security controls, manage a private bug bounty, and grow a Security Champions network across a globally distributed team, while conducting threat modeling for Java and Python microservices.

Join a remote-first company with flexible work arrangements and a strong focus on security for payments at scale.

Qualifications

• 3–5+ years in Application Security and/or full stack development.
• Experience conducting secure code assessments for Java and Python apps.
• Skilled at integrating SAST/DAST tools into CI/CD pipelines.
• Experience running bug bounty programs and defining metrics.
• Experience with STRIDE threat modeling.

Responsibilities

• Automate Security Controls: Integrate proactive security tooling into CI/CD pipelines.
• Define & Drive Secure SDLC: Design, communicate, and maintain developer-friendly SDLC processes and threat modeling.
• Manage Bug Bounty & Triage: Lead private bug bounty program and triage reports.
• Build Engineering Capability: Provide secure coding training and foster a Security Champions network.
• Lead AppSec Reviews: Conduct threat models and code reviews for Java and Python microservices.
• Amplify Security Culture: Collaborate on technical blogs and vulnerability disclosures.

Skills

AppSec experience

Technical depth

Tooling & automation

Vulnerability & program mgmt

Threat modeling

Collaborative mindset

Education

BA/BS degree

Tools

GitHub Advanced Security

ZAP/BURP

Synopsys/Veracode

Semgrep

Job description

VGS is hiring an Application Security Engineer to partner across Security and Engineering, shaping a developer-friendly Secure SDLC and embedding security into CI/CD.

You will automate security controls, manage a private bug bounty, and grow a Security Champions network across a globally distributed team, while conducting threat modeling for Java and Python microservices.

Join a remote-first company with flexible work arrangements and a strong focus on security for payments at scale.