About the Company
An established Canadian fintech with more than a decade in market and a large customer base across lending, credit-building, and mortgage products. Customers apply and manage their accounts online, by text, or by phone, so the platform carries sensitive financial and personal data at real scale.
The engineering culture is product-led and practical. People are trusted with ownership and expected to build systems that hold up as the business grows.
The Role
Hybrid, 3 days a week in a downtown Vancouver office. This is the senior hands-on owner of application security across the company. You’ll set the AppSec direction, build the secure development process into how engineers already ship, and be the person leadership turns to when a security trade-off needs a clear answer. It suits someone who has stood up or rebuilt an AppSec program inside a product company, not someone who has only advised from the outside. It’s primarily an individual contributor seat, with room to lead a small team as the function grows.
What You Will Do
- Build and run the secure development lifecycle, wiring SAST, SCA, secrets scanning, and dependency checks into CI/CD, then tightening them from warnings to enforced gates with a sensible exception path.
- Lead threat modeling and design reviews for the most sensitive services, APIs, and cloud workloads, working directly with product, DevOps, and platform engineers.
- Decide how vulnerabilities get ranked, assigned, fixed, or formally accepted, and report the company’s security posture to executives through metrics and a living risk register.
- Choose and roll out tooling such as DAST, SBOM, WAF, and CSPM, judging each by measurable results rather than coverage on paper.
- Use AI to widen review and detection coverage, set guardrails for AI-powered features against prompt injection, data leakage, and overly broad agent access, and drive app-level SOC 2 and PIPEDA evidence alongside incident response.
What You Bring
- 5+ years across application security, security engineering, or software engineering, including at least 2 years as the technical owner of security initiatives.
- Proven experience embedding security into CI/CD and agile delivery, with hands-on tuning of tools such as Snyk, GitHub Advanced Security, Semgrep, Checkov, or Burp Suite to cut noise and prove impact.
- Working fluency in STRIDE or PASTA, the OWASP Top 10, and secure coding across web apps, microservices, containers, and API gateways on AWS.
- A strong handle on identity and secrets: OAuth/OIDC, SSO, token handling, and least-privilege cloud IAM.
- A practical, critical view of AI in security work and the risks it introduces. SOC 2, PCI DSS, ISO 27001, or Canadian privacy experience is a plus, as are certifications like OSCP, OSWE, BSCP, or AWS Security Specialty.
Why This Role
You’d own AppSec end to end at a regulated fintech where security directly underpins customer trust, with the authority to shape the roadmap rather than inherit someone else’s. The position is permanent and hybrid, with three set days a week in a downtown Vancouver office. Health, dental, and vision premiums are fully covered, and there’s a retirement savings match
