Staff Application Security Specialist

🕒 April 22

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Workleap

WebsiteLinkedInAll Job Openings

201 - 500 employees

👥 HR Tech

☁️ SaaS

⚡ Productivity

💰 Private Equity Round on 2023-06

HR Tech • SaaS • Productivity

Workleap is a company that provides an integrated platform designed to improve the employee experience by focusing on engagement, performance, and development. Their suite of products includes Officevibe, Pingboard, and various Learning Management Systems (LMS) that help businesses tackle challenges like hybrid work, onboarding, professional development, and performance management. Workleap aims to create happier and more productive workplaces by making it easier for HR teams to manage and enhance their HR strategies. With a customer base exceeding 20,000 leaders globally, Workleap offers tools that are easy to implement and integrate with existing HR and productivity systems.

📋 Description

• Build the security layer for how Workleap writes software and teach it to run itself • Wire SAST, DAST, SCA, and secret scanning into GitHub Actions with low-noise findings • Lead threat modeling on architectural changes and new features • Manage vulnerability intake, triage, and remediation • Develop agentic security review for automated first-pass pull request analysis • Build security guardrails for AI-assisted and agentic development • Move security review toward automated first-pass analysis with human judgment for ambiguous cases • Achieve near-zero developer friction on security signals through CI/CD integration • Drive remediation of application security vulnerabilities based on risk retired • Harden Azure environments and deployment patterns alongside Infrastructure SecOps • Write code as a hands-on individual contributor • Partner with the AI SDLC team and product engineering • Report to the Director of Infrastructure and Security

🎯 Requirements

• Five or more years in application security, DevSecOps, or security-focused software development • Real engineering background • Deep working knowledge of web application security, OWASP Top 10, and CWE Top 25 • Proven experience building security automation into CI/CD pipelines; GitHub Actions preferred • Built and shipped agent tooling, including MCP servers, Claude skills, subagents, and custom tools • Context engineering expertise for agent reasoning over codebases • Understanding of agentic-system security, including prompt injection, tool permission scoping, credential handling, and repository write-access risks • Proficiency in Python for building tooling • Hands-on experience with AI-assisted and agentic development workflows • Solid grasp of Azure services, infrastructure security, and deployment patterns • Ability to explain risk tradeoffs to engineers and executives • Secure code review experience in C#/.NET • Experience integrating SAST, DAST, SCA, and secret scanning at scale • Familiarity with OIDC, SAML, and OAuth • Exposure to SOC2 requirements • Experience running vulnerability discovery and triage with a developer community

🏖️ Benefits

• Annual bonus program • LTIP program, share in Workleap's long-term growth • RRSP • Family health insurance • Telemedicine • Annual wellness budget • Flexible vacation policy • Remote work, with access to our Montreal office • In-person gathering twice a year • Claude access, for everyone