Product Security Specialist II

Accountabilities:

Collaborate with developers, product managers, customer experience teams, customers, and partners to communicate security requirements clearly and adapt technical explanations to different audiences.
Manage security questionnaires, assessments, and customer or partner security meetings, providing accurate information and supporting confidence in product security practices.
Develop, maintain, and improve product security policies, standards, procedures, and documentation across key security domains.
Contribute to risk management activities by maintaining the security risk register, monitoring compliance with established policies, and identifying opportunities to strengthen security controls.
Conduct security and compliance reviews of third-party libraries, vendor components, and software dependencies, assessing licensing requirements, known vulnerabilities, and other risk indicators.
Support the AI security and governance program by developing standards for AI-assisted software development, monitoring emerging AI-related security risks, and helping deliver training and awareness initiatives for Engineering teams.
Contribute to the vulnerability disclosure process, including Common Vulnerabilities and Exposures (CVE) registration, security advisory preparation, vulnerability coordination, and post-incident reviews.
Own ongoing security coverage for applications and services developed outside core Engineering, including public-facing websites, APIs, internal tools, IT-developed scripts, and internally used AI agents.
Assess the security posture of non-engineering applications and services, identify weaknesses, and coordinate appropriate remediation and ongoing monitoring.
Support the integration of security practices throughout the software development lifecycle, including secure development standards, application security testing, and software supply chain security.
Track security performance indicators, maintain governance dashboards, and prepare reports for leadership and external stakeholders.
Analyze security findings, incomplete data, and emerging risks to prioritize actions and provide practical recommendations.
Work independently to manage assigned security domains while collaborating with the broader security team and Engineering stakeholders.
Identify opportunities to improve security processes, developer enablement, compliance practices, and overall security program maturity.
Requirements:
At least three years of professional experience in product security, application security, or a closely related cybersecurity discipline.
Strong technical cybersecurity knowledge, including common vulnerability classes, secure software development practices, and application security tools and methodologies.
Familiarity with the OWASP Top 10 and security testing tools and practices, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA).
Proficiency in Python for automation, security tooling, data analysis, or workflow improvement.
Experience with agentic AI systems and an understanding of the security considerations associated with AI-assisted development or autonomous AI agents.
Demonstrated ability to explain security concepts clearly to stakeholders with varying levels of technical knowledge, including engineers, business teams, customers, and external partners.
Strong analytical and problem-solving skills, with the ability to interpret complex, noisy, or incomplete information and translate findings into actionable recommendations.
Excellent written communication and documentation skills, including the ability to develop security policies, prepare technical reports, and communicate vulnerability findings effectively.
A relevant degree in Computer Science, Cybersecurity, Information Technology, or a related field, or equivalent practical experience.
Strong organizational skills and the ability to manage multiple security responsibilities, prioritize risks, and work independently with minimal supervision.
A collaborative, proactive mindset, with sound judgment, attention to detail, and a commitment to continuous learning and improvement.
Additional qualifications considered an asset:
Familiarity with security and compliance frameworks such as SOC 2 and ISO 27001.
Relevant professional security certifications, such as CISSP, CISM, or equivalent credentials.
Experience using, supporting, or securing FME in production environments.
Experience with vulnerability disclosure coordination, CVE registration, security advisories, or incident postmortems.
Familiarity with software supply chain security, third-party risk management, and governance of AI-enabled development tools.
Experience securing public-facing applications, APIs, internal business tools, automation scripts, or AI agents.
Benefits:
Competitive salary: Annual base salary ranging from CAD $102,000 to $115,000, with potential flexibility based on qualifications, experience, and other role-related factors.
Performance bonus: Eligibility for additional bonus compensation.
Fully remote work: Remote working arrangements for candidates across Canada, excluding Quebec.
Flexible working hours: Flexibility to organize your workday around your responsibilities and lifestyle.
Comprehensive health coverage: Extended health and dental benefits beginning on your first day of employment.
Wellness support: Access to health or lifestyle spending benefits and counseling services from day one.
Retirement savings: RRSP/TFSA matching to support long-term financial planning.
Shared success: Biannual profit-sharing opportunities that allow employees to participate in organizational success.
Paid time off: Three weeks of vacation annually, plus six additional paid seasonal days off each year.
Parental support: A parental leave top-up program for eligible employees welcoming a child through childbirth or adoption.
Professional development: An annual learning budget and employer-funded training programs to support continuous learning and career advancement.
Career progression: Opportunities to take ownership of specialized security domains and progress toward a senior product security role.
Meaningful work: The opportunity to influence product security strategy, strengthen software protection, and support responsible AI adoption.
Community engagement: Paid time off to participate in employer-organized volunteering initiatives that support community programs.
Inclusive workplace: A collaborative environment that values diverse backgrounds, new ideas, autonomy, and continuous improvement.
Accessible recruitment: Accommodations are available throughout the hiring process to support candidates who require them.