Application Security Developer
About The Position
Clio is seeking an Application Security Engineer to join its Security team. The team focuses on emulating adversaries to find and help fix security vulnerabilities in applications. This role involves providing an adversarial perspective, challenging defenses, and collaborating with development teams to prevent exploitation. The position is ideal for someone passionate about building innovative solutions, tackling new challenges, and making an impact. This role is open to candidates across Canada (excluding Quebec). Candidates located near Clio's hubs (Burnaby, Calgary, or Toronto) are expected to work from the office a minimum of two days per week for Anchor Days.
Requirements
- Experience in Application or Product Security, with a focus on offensive security and penetration testing.
- Hands-on expertise identifying and exploiting complex vulnerabilities (e.g., SSRF, Deserialization, logic bypasses).
- Proven ability to lead and conduct formal threat modeling sessions.
- Strong proficiency in at least one major programming language (e.g., Python, .NET, Ruby, JavaScript).
- Experience securing applications in modern cloud environments (AWS, Azure, or GCP).
- Expertise with common application security tools and platforms (e.g., Burp Suite, SAST, SCA).
- Experience with log aggregation and SIEM technologies.
- Ability to identify malicious behaviour and emerging threats via log analysis.
- Demonstrate a keen interest in improving your craft by using AI.
Nice To Haves
- Security certifications such as OSCP or OSWE.
- Active participation in the security community (e.g., presenting at conferences, contributing to open-source tools).
- Experience with Ruby on Rails, Puppet, Kubernetes, Terraform, ELK (Elastic, Logtash and Kibana).
- Strong AWS security experience on EC2 and managed services.
- Infrastructure security (WAF, ACLs, authentication, device hardening).
Responsibilities
- Write, review, debug, and implement tools to help developers avoid security flaws.
- Build partnerships with development teams and advise on security best practices.
- Contribute to collective developer education by driving security awareness and knowledge amongst the product organization.
- Provide detailed guidance and support to teams in vulnerability remediation, and develop frameworks, guidelines, and systematic fixes for recurring vulnerabilities.
- Resolve issues, navigate ambiguity, and maintain positive working relationships with researchers in our Bug Bounty program.
- Identify and implement tools for automated application scanning, static analysis and related tools.
- Perform penetration testing, and offensive campaigns against internal assets.
- Perform reactive incident response and forensics when a security event occurs.
- Perform proactive research to detect new attack vectors.
- Elevate and educate our security culture within Clio, contributing to our cultural values.
Benefits
- Competitive, equitable salary
- Top-tier health benefits
- Dental insurance
- Vision insurance
- Hybrid work environment
- Flexible time off policy, with an encouraged 20 days off per year.
- $2000 annual counseling benefit
- RRSP matching
- RESP contribution
- Clioversary recognition program with special acknowledgement at 3, 5, 7, and 10 years
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
Education Level
No Education Listed
