As of November 6, 2026, Jobsy lists 20 application security engineer jobs in Canada. The most active employers are Accelerant, Spring Financial Inc. and BioRender. Skills often requested: aws, python, ci/cd and penetration testing.
No matching filters. Try another name.
TSX Inc.
3+ YOECandidates need 3+ years of application security engineering, penetration testing and secure code review experience. They must know OWASP Top 10 and CWE Top 25, secure development practices, cloud and microservices security, and tools such as Burp Suite and SAST/DAST scanners.
Burp Suite Professional, SQLmap, Wireshark, SAST tools, DAST tools, CSPM tools
Paymentus: Paymentus® (NYSE: PAY) is the leading provider of real-time, cloud-based billing, payment, and customer engagement solutions.
6+ YOECandidates need 6+ years of hands-on software or security engineering experience, strong coding skills in Java, NodeJS, Python or Golang, and deep knowledge of application, API and LLM security. A bachelor's degree in a technical field or equivalent practical experience is also required.
SAST, DAST, SCA, Kubernetes, Cloudflare, Fastly
Accelerant
5+ YOECandidates need five or more years in application security, product security or DevSecOps, with strong knowledge of web and API security and the OWASP Top 10. Experience with vulnerability scanning tools, CI/CD security, WAF management, AWS and Kubernetes, and Python scripting is needed.
Snyk, Qualys, Trivy, Dependabot, GitHub Advanced Security, AWS
Accelerant
5+ YOECandidates need 5+ years in application security, product security or DevSecOps, with strong knowledge of web and API security and the OWASP Top 10. Experience with vulnerability scanning tools, CI/CD security and cloud security on AWS and Kubernetes is expected, plus Python scripting skills.
Snyk, Qualys, Trivy, Dependabot, GitHub Advanced Security, WAF
BioRender
Candidates need strong software engineering skills in Node.js and React, with Python a plus, and hands-on web application security and secure coding experience. They should have SAST/DAST and CI/CD integration experience, AWS and Terraform security skills, threat modeling, and working knowledge of cryptography, PKI and TLS.
AWS, Terraform, Cloudflare, HackerOne, SAST tools, DAST tools
Spring Financial Inc.: Spring Financial is a leading financial technology company that provides all Canadians with simplified money solutions to help build credit, save…
5+ YOE2+ MgmtSpring Financial needs 5+ years in application or security engineering, including 2+ years leading security initiatives. Candidates need deep knowledge of web and cloud security, the OWASP Top 10, threat modeling, CI/CD security integration, and automated security testing tools.
Snyk, GitHub Advanced Security, Burp Suite, Semgrep, Checkov, AWS
Spring Financial Inc.: Spring Financial is a leading financial technology company that provides all Canadians with simplified money solutions to help build credit, save…
3+ YOESpring Financial needs 3+ years in application or software security, solid knowledge of OWASP Top 10 and cloud security, and code review skills in a modern language. Candidates should have threat modeling experience (STRIDE or PASTA), hands-on tuning of tools like Snyk, Semgrep or Burp Suite, and knowledge of OAuth/OIDC, JWT, Vault and AWS IAM.
Snyk, GitHub Advanced Security, Burp Suite, Semgrep, Checkov, AWS IAM
CGI
Candidates need senior experience in application security and vulnerability remediation. They should be comfortable working with AI-assisted coding tools.
VGS
3+ YOECandidates need 3-5+ years of Application Security or full stack development experience, including secure code review of Java and Python applications. Hands-on work with SAST and DAST tools in CI/CD, bug bounty operations and STRIDE threat modeling are also required, along with strong communication skills.
GitHub Advanced Security, GitLab, Semgrep, Veracode, Synopsys, ZAP
Nutrien
6+ YOECandidates need 6-8 years of related experience, a strong application development background and deep knowledge of vulnerability management and security frameworks. Hands-on work with scanning tools, cloud and container environments, and scripting in Python or Bash is expected.
Qualys, Tenable, Snyk, TruffleHog Pro, Python, Bash
Opendoor
Candidates need application security or software engineering experience with a security focus, strong coding skills in Python, Go, TypeScript or Ruby, and hands-on use of security scanning tools. They also need knowledge of API vulnerabilities, threat modeling, and cloud and Kubernetes security.
GitHub Advanced Security, Semgrep, HackerOne, Burp Suite, Cloudflare WAF, Apollo GraphQL
Thumbtack
4+ YOECandidates need 4+ years of software engineering or application security experience, with practical skill in threat modeling, authentication, secrets management and OWASP Top 10 risks. Strong written and verbal communication and a growth mindset are also required.
Security threats, Documentation, Incident response, Communication skills, Recruitment
Relay: Relay is a financial technology company and is not an FDIC-insured bank.
5+ YOECandidates need 5 to 6 years of application security or penetration testing experience, production software shipping experience, deep knowledge of OWASP Top 10, and daily use of AI tools for development. Strong communication and developer mentorship skills are also expected.
Datadog, Burp Suite, Claude Code, Cursor, TypeScript, Node.js
Capco: Capco, a Wipro company, is a global technology and management consultancy specializing in driving digital transformation in the financial services…
10+ YOECandidates need 10+ years in network security, application security or infrastructure, with substantial hands-on WAF experience, ideally with Cloudflare or Akamai. They also need practical knowledge of DNS, HTTP/HTTPS, TLS and traffic routing, plus experience tuning WAF rules and working across teams.
Cloudflare, Akamai
Accelerant (2), Spring Financial Inc. (2), BioRender (1), Capco (1) and CGI (1).
Postings most often mention aws, python, ci/cd, penetration testing, communication skills, github, security threats and incident response.
18 companies