Lead Product Security

Accountabilities:

• Lead security architecture and design reviews across core product lines, providing actionable guidance before implementation begins.
• Contribute to and scale threat modeling practices by coaching engineers to conduct their own models and reviewing results.
• Define security requirements, design gates, product security baselines, and standards that establish a practical definition of secure-by-default.
• Build and measure secure development lifecycle practices across SCA, SAST, DAST, secret scanning, dependency management, and build pipeline integrity.
• Conduct deep secure code reviews in high-risk areas such as authentication, authorization, cryptography, secrets management, and input validation.
• Strengthen product supply chain and release security, including SBOM generation and the integrity of build and distribution artifacts.
• Develop and expand the Security Champions program through recruitment, training, enablement content, office hours, and outcome tracking.
• Mentor engineers and security professionals on secure design, threat modeling, and secure code review to scale security expertise across teams.
• Coordinate penetration tests and third-party security assessments, triaging findings and driving remediation through completion.
• Partner with PSIRT on product vulnerability triage, remediation, and coordinated response, using root-cause insights to improve engineering and SDLC controls.
• Assess product security maturity using frameworks such as BSIMM or SAMM and drive a prioritized improvement roadmap.
• Support secure-by-design regulatory requirements, including the EU Cyber Resilience Act, through technical evidence and process improvements.
• Provide subject matter expertise for customer security questionnaires, audits, RFPs, and security escalations, while building reusable, vetted response documentation.
• Support incident response involving product code, build systems, or product infrastructure with product-specific security expertise and remediation guidance.
• Lead discrete technical workstreams, track milestones, and contribute to application security tooling evaluations and proof-of-concepts.

Requirements

• Bachelor’s degree in Computer Science, Information Security, Information Technology, or equivalent practical experience.
• 8+ years of experience in product security, application security, or software security engineering, with strong hands-on experience in secure design reviews, threat modeling, and secure code review.
• Experience building or operating a Security Champions program, developer security training initiative, or comparable security enablement program.
• Strong knowledge of application security tooling, including SCA, SAST, DAST, and secret scanning, along with an understanding of their detection capabilities and limitations.
• Practical secure coding and code review experience in at least one commercial software programming language, with the ability to assess unfamiliar code.
• Experience defining security requirements, standards, or design gates that have been adopted by engineering teams.
• Familiarity with AWS, Azure, or GCP from a product security perspective, including container and infrastructure-as-code security.
• Experience coordinating penetration tests or third-party assessments and driving identified issues through remediation.
• Demonstrated ability to mentor engineers and lead technical initiatives without relying on formal management authority.
• Awareness of AI and LLM security risks, including prompt injection, sensitive data exposure, and the OWASP Top 10 for LLM Applications.
• Practical experience using AI and LLM tools to accelerate security work, with sound judgment around validating AI-generated outputs before they are acted upon or shared.
• Strong written and verbal communication skills, with the ability to explain technical security concepts to engineering, security, and non-technical stakeholders.
• Experience with PSIRT or equivalent product vulnerability response processes, including CVSS scoring and coordinated disclosure, is a plus.
• Familiarity with BSIMM, SAMM, secure-by-design practices, or EU Cyber Resilience Act requirements is a plus.
• Certifications such as CSSLP, CISSP, GWAPT, OSWE, or relevant cloud security certifications are a plus.
• Experience supporting customer security questionnaires, RFPs, or third-party risk assessments is a plus.
• Comfortable working extensively at a computer and participating in occasional phone-based communication, with the ability to lift or move items up to 20 pounds when required.
• Willingness to travel occasionally as needed.

Benefits

• CAD $117,000–$150,000 salary range.
• Remote position based in Canada.
• Opportunity to influence product security strategy and secure software development practices at scale.
• Broad technical ownership with significant autonomy and cross-functional exposure.
• Opportunities to mentor engineers and develop security capabilities across product teams.
• Exposure to modern application security, cloud security, AI/LLM security, software supply chain security, and vulnerability management.
• Potential opportunities to contribute to regulatory readiness and security maturity initiatives.
• Occasional travel opportunities as required by the role.