AppSec Analyst

Job Title: AppSec Analyst
Location: Hybrid - Downtown Toronto
Job Type: 12-month contract to start

We are seeking a highly technical, Expert-Level Information Security or AppSec Analyst. In this role, you will lead hands-on application security operations, secure our client’s software development lifecycles, and drive modern DevSecOps strategies as an individual contributor. You will be responsible for integrating, managing, and hardening security scanning tools directly within CI/CD pipelines, with a strong focus on third-party component risk and Software Composition Analysis (SCA). Beyond standard operational oversight, you will take ownership of a high-visibility innovation initiative: planning, implementing, and running a Proof of Concept (POC) for an AI-enabled security tool.

Responsibilities:

• CI/CD & Pipeline Security Integration
• Design, implement, and maintain automated security testing controls embedded within CI/CD pipelines.
• Ensure seamless, frictionless developer workflows by tuning scanners to reduce noise, eliminate false positives, and optimize build performance.
• Establish pipeline guardrails and policy enforcement to prevent insecure code and vulnerable dependencies from reaching production.

• Lead Software Composition Analysis (SCA) operations across all software repos to manage third-party and open-source software risks.
• Secure the software supply chain from a pipeline perspective by implementing automated dependency checks, license compliance tracking, and patch verification.
• Partner with engineering teams to triage, prioritize, and remediate CVEs originating from third-party dependencies and transitive libraries.

• Manage and operationalize enterprise application security tools, specifically leveraging Snyk and GitHub Advanced Security (GHAS) (including SAST, Secret Scanning, and Dependabot).
• Drive automated security testing strategies across static, dynamic, and dependency analysis tooling.
• Monitor security analytics and metrics to measure pipeline security coverage, remediation velocity, and service level agreement (SLA) adherence.

• Spearhead the strategy, architecture, rollout, and evaluation of a Proof of Concept (POC) for a cutting-edge AI-enabled security tool.
• Define success criteria, benchmark performance against traditional scanners, and assess developer experience and remediation efficiency.
• Deliver executive findings and rollout recommendations following the POC execution.

Qualifications:

• Minimum 5+ years of hands-on experience in Information Security, Application Security, or DevSecOps roles.
• Tooling Expertise: Demonstrated proficiency with Snyk, GitHub Advanced Security (GHAS), JFrog and Akamai.
• Pipeline Mastery: Strong experience embedding security automation into CI/CD workflows (e.g., GitHub Actions, GitLab CI, Jenkins).
• Supply Chain Security: Deep knowledge of Software Composition Analysis (SCA), SBOM management, and securing third-party open-source libraries at pipeline speed.
• Automated Testing: Broad expertise in automated security testing methods (SAST, SCA, Secret Scanning, DAST).
• AI Familiarity: Practical experience or strong working knowledge of AI/ML application security concepts or AI-driven developer productivity tools.
• Accountability: Takes full ownership of security outcomes, tool performance, and pipeline stability.
• Collaboration: Works effectively as a bridge between Security, DevOps, and Software Development teams to drive secure coding without blocking delivery.
• Initiative: Self-starter who proactively identifies gap areas in security posture, pilots innovative solutions, and continuously improves operations.