Application Security Engineer Canada Remote - 3 months contract

Role: Application Security Engineer

Location: Canada – Remote

Domain: Healthcare

Contract : 3 months with possible extension

Additionally as we see that senior level candidates are currently facing rejections we would like to focus more on looking for more expert candidates (higher then seniors)

Job description:

What they'll do:

1. Remediate application security findings hands-on: read the code, write the fix, open the PR. This is a dev-facing role, not a ticket-filing role.
2. Deploy, configure, and tune SAST and SCA tooling in our CI/CD pipelines and repos, including rule tuning and false positive cleanup.
3. Triage findings from SAST, SCA, and pen tests, prioritize them, and drive them to closure with engineering teams.
4. Review PRs and designs for security issues and help build secure coding guidance for developers.

What we need:

1. Software development background in Python and Go. Must be comfortable writing production code and opening PRs.
2. Hands-on AppSec experience, especially vulnerability remediation (OWASP Top 10, dependency vulns, secrets, auth/session issues).
3. Direct experience deploying and operating SAST and SCA tools in CI/CD, not just consuming their output.
4. Works well with developers and can explain findings in plain language.
5. Available during US business hours.

Nice to have: healthcare or other regulated-industry experience.