Senior Application Security Engineer

Spring Financial

. Shape and drive Spring’s application security strategy and roadmap .

Posted 10/24/2026full-timeVancouver • CanadaSenior💰 CA$130,000 - CA$150,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in application security strategy, secure development practices, and integrating security into CI/CD workflows. Proficient in threat modeling, security tools, and compliance initiatives, with a strong focus on mentoring and leading security teams.

Highest-signal resume keywords

Application Security StrategySecure Development Lifecycle (SDL)Threat Modeling Frameworks (STRIDE, PASTA)Cloud-Native Architecture (AWS, Microservices)Security Compliance (SOC 2, PIPEDA)

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Application SecuritySecure Coding Best PracticesSecurity Testing AutomationVulnerability ManagementIncident ResponseRisk AssessmentSecurity Architecture ReviewsAI Security PracticesDependency ManagementStatic and Dynamic Analysis

Soft Skills

LeadershipMentoringCross-Functional CollaborationInfluencing Without AuthorityCommunication

Tools & Technologies

SnykGitHub Advanced SecurityBurp SuiteSemgrepCheckovWAFCSPMAI Security ToolsCI/CD ToolsSecurity Metrics Tracking

Certifications & Qualifications

OSCPOSWEBSCPAWS Security SpecialtyAI Security Training

Industry Keywords

OWASP Top 10Cloud IAMOAuth/OIDCSSOPIPEDAPCI DSSISO 27001Bug BountySecurity ResearchOpen-Source Security Contributions

Tech Stack

Tools & technologies

AWSCloudMicroservicesSpring

About the role

Key responsibilities & impact

Shape and drive Spring’s application security strategy and roadmap
Lead secure development practices across engineering, including threat modeling, secure code review, dependency management, and static and dynamic analysis
Define and manage Spring’s Secure Development Lifecycle, embedding security reviews, tooling, and guardrails into CI/CD workflows
Partner with engineering, DevOps, and platform teams to identify and remediate risks across applications, services, APIs, and cloud environments
Evaluate, select, and implement security tools and services such as SAST, DAST, SBOM, secrets scanning, WAF, and CSPM
Champion responsible use of AI in application security workflows and integrate AI into security tooling and detection capabilities
Set security standards for AI-powered features and internal AI tooling, addressing prompt injection, data leakage, and excessive agent permissions
Own or contribute to incident response for application vulnerabilities and exposures, lead post-incident learning, and implement systemic improvements
Support SOC 2 readiness, audit participation, evidence gathering, and privacy obligations such as PIPEDA
Advise product and engineering teams on secure architecture, data protection, and third-party risk
Mentor and grow the application security team and potentially lead a small team of engineers
Track and communicate security posture through metrics, risk registers, and executive-level reporting

Requirements

What you’ll need

5+ years of experience in application security, software engineering, or security engineering, including at least 2 years leading security initiatives or acting as a technical owner
Deep knowledge of web and cloud application security principles, the OWASP Top 10, and secure coding best practices
Proven experience implementing SDL processes and integrating security into CI/CD pipelines and agile environments
Ability to define how vulnerabilities are prioritized, tracked, and closed, including remediation targets, exceptions, and risk acceptance
Fluency in threat modeling frameworks such as STRIDE and PASTA and secure architecture reviews for business-critical systems
Strong familiarity with cloud-native architecture, including AWS, microservices, containerization, and API gateways
Deep hands-on experience operating automated security testing at scale, including tuning, noise reduction, and measuring effectiveness
Experience with tools such as Snyk, GitHub Advanced Security, Burp Suite, Semgrep, Checkov, or similar
Solid understanding of identity, access, and secrets management patterns, including OAuth/OIDC, SSO, token handling, cloud IAM, and least privilege
Track record of leading cross-functional security initiatives and influencing engineering and business stakeholders without authority
Strong grasp of AI tools relevant to application security, their responsible use, and security risks introduced by AI
Experience supporting compliance initiatives such as SOC 2, PCI DSS, PIPEDA, or ISO 27001 is a plus
Relevant security certification such as OSCP, OSWE, BSCP, or AWS Security Specialty is nice to have
AI security training or certification is nice to have
Regular hands-on security practice is nice to have
Bug bounty findings, security research, or open-source security contributions are nice to have
Experience building or scaling a security program at a growth-stage company is nice to have

Benefits

Comp & perks

Comprehensive benefits package, including extended health, dental, and vision coverage — with 100% of monthly premiums covered by the Spring
GRSP matching program to support your long-term financial goals
A modern, collaborative workspace in the heart of downtown Vancouver
Ongoing career growth opportunities
Hybrid work arrangement: 3 set days in the office and 2 WFH