Senior Engineer, Application Security

Overview

We are seeking a Senior Application Security Engineer to anchor our Application Security team and spearhead the transition towards embedding security deeply within the software development lifecycle. This role emphasizes implementing Secure by Design principles, leveraging AI-driven automation, and fostering collaboration between development and security operations to mitigate sophisticated threats.

Key Responsibilities

• Implement end-to-end Secure by Design strategies by integrating security measures into feature designs, code reviews, infrastructure checks, and engineering workflows.
• Develop and validate advanced threat models for product features and infrastructure, enhancing AI-based threat modeling pipelines.
• Manage and optimize security scanning tools such as SAST, DAST, SCA, Secrets detection, and LLM scanners to reduce false positives and improve vulnerability management efficiency.
• Establish and refine Application Security processes while maintaining legacy security systems.
• Drive AI-powered automation initiatives to speed up vulnerability triage and remediation, actively reducing security backlog.
• Offer direct technical guidance to developers for resolving complex software vulnerabilities and architectural flaws.
• Lead developer security enablement programs including Security Champions initiatives and secure coding workshops to enhance security awareness across engineering teams.
• Collaborate closely with Platform and Infrastructure Security teams to integrate automated security guardrails within CI/CD pipelines.

Candidate Profile

• Extensive, practical experience in Application Security, Product Security, or Secure Software Engineering within fast-paced cloud environments.
• Educational background with a bachelor's degree in Computer Science, Cybersecurity, Software Engineering, or equivalent hands-on experience.
• Comprehensive knowledge of web application threats including OWASP Top 10 vulnerabilities, business logic flaws, and secure development practices.
• Proven ability to configure and tune SAST, DAST, SCA, Secrets, and LLM scanning tools in continuous integration and deployment contexts.
• Experience in threat modeling, applying Secure by Design principles, and supporting developers through code security remediations.
• Demonstrated use of AI and large language models to automate security analysis, accelerate triage, and enhance developer security workflows.
• Proficiency with modern programming languages such as Python, Go, JavaScript/TypeScript, and Java.
• Strong communication and leadership skills to effectively run programs like Security Champions and deliver engaging security training.

Benefits and Culture

• Be part of a growing team with significant opportunity for career progression.
• Comprehensive benefits including equity ownership for all employees.
• Ample autonomy with a flexible and supportive work environment.
• Dedicated time for personal innovation and learning.
• Participation in cultural and technical decision-making committees.
• Opportunities to advance into leadership or specialized technical roles.
• Work with a fast-scaling, diverse, and inclusive Canadian tech company.
• Additional perks such as flexible paid time off, remote work options, health insurance, RRSP pension contributions, wellness benefits, parental leave, mental health resources, training programs, volunteer opportunities, stocked kitchen, and social events.

Additional Information

The company values inclusivity and diversity, encouraging applicants from all backgrounds including people with disabilities and members of the LGBTQ+ community. Criminal record checks are part of the hiring process, and accommodations are offered throughout the recruitment cycle as needed. Unsolicited agency résumés are not accepted.

Lightspeed is a global commerce platform powering retail, hospitality, and golf businesses in more than 100 countries. Founded in 2005 in Montreal, it is publicly traded on the NYSE and TSX.