Role overview

As a Senior Application Security Engineer, you will anchor the AppSec team at Lightspeed, driving a strategic shift toward embedding security directly into developer workflows and operationalizing Secure by Design principles. You will design and scale modern application security practices while working alongside Vulnerability Operations to streamline how security issues are triaged and resolved across the organization.

Key responsibilities

Embed security controls seamlessly into feature designs, pull requests, infrastructure-as-code checks, and daily engineering workflows to operationalize Secure by Design principles end-to-end.
Architect and validate threat models for high-impact features and infrastructure, enhancing AI-generated threat modeling pipelines.
Configure and tune SAST, DAST, SCA, Secrets, and LLM scanner rulesets to reduce false positives and support efficient vulnerability operations.
Build and stabilize new AppSec processes while maintaining the effectiveness of existing security controls across the organization.
Develop AI-driven automation solutions to accelerate vulnerability triage and remediation, systematically reducing security backlogs.
Provide technical guidance to developers on remediating complex structural and web application vulnerabilities.
Lead developer security enablement through the Security Champions program and hands-on secure coding workshops.
Partner with Platform and Infrastructure Security teams to build automated guardrails into CI/CD pipelines.

Requirements

Deep, hands-on experience in Application Security, Product Security, or Secure Software Engineering within high-growth cloud environments.
Bachelor’s degree in Computer Science, Cybersecurity, or Software Engineering, or equivalent practical experience.
Strong understanding of web application vulnerabilities including OWASP Top 10, business logic flaws, and secure coding practices.
Proven experience tuning SAST, DAST, SCA, Secrets, and LLM scanner pipelines in CI/CD environments.
Demonstrated expertise with threat modeling methodologies, Secure by Design principles, and guiding developers through code remediations.
Experience leveraging AI and LLM tools to automate security analyses and optimize developer security workflows.
Fluency in modern software development languages such as Python, Go, JavaScript/TypeScript, or Java.
Strong cross-functional communication and influence skills to lead security initiatives across teams.

What makes this role worth considering

You will join a growing AppSec team at Lightspeed, a Canadian tech company founded in 2005 that is building a one-stop commerce platform for businesses worldwide. The role offers autonomy, flexible work culture, and innovation time to explore new approaches, alongside opportunities for growth into technical or people management positions.

Lightspeed provides equity ownership for all employees, flexible paid time off and remote work policies, health insurance, RRSP pension contributions, annual wellness benefits, parental support, mental health services, training and development opportunities, volunteer days, and collaborative social events.