Application Security Engineer

Canopy•South Jordan, UT

15h•Remote

About The Position

Application Security Engineer Canopy, South Jordan, UT About Us Canopy is a fast-growing SaaS company in South Jordan, Utah building simple, powerful software for accounting firms. We're on a mission to help accountants build an autonomous firm — giving them back the time and tools they need to focus on what matters most: their clients. We believe the accounting industry deserves world-class software, and we're building exactly that. Our Practice Management Suite is purpose-built for firms that want to work smarter, grow faster, and deliver more value to the people they serve. We place a strong emphasis on delighting our customers, spotting and solving problems, and being good people along the way. Click here to see why our clients (and investors) love Canopy. Interested in learning more about Canopy & the industry? Check out our blog here where you can find great information on our product features, industry news, practice management, and more! The Opportunity As we scale, so does the trust our customers place in us to protect their data. We're hiring a Senior Application Security Engineer to help harden our platform — from how we isolate workloads and control access, to how we secure our network, harden our applications, achieve audit-grade observability, and lock down our software supply chain. This is a hands-on, high-ownership role. You'll be a primary builder on a broad security roadmap spanning cloud infrastructure, identity, network, application, observability, and the software supply chain — turning it into shipped, operational reality alongside platform, infrastructure, and product engineering teams. We're looking for someone who can go deep on any one of these areas when needed, while staying comfortable moving across all of them, and who has a sharp read on how AI is reshaping both the threats we defend against and the tools we defend with. This position is fully remote in Utah.

Requirements

8+ years of professional experience in application security, security engineering, or a closely related discipline, with a track record of driving substantial security initiatives from design through to production
Deep, hands-on expertise across most of the following: cloud account/organization security (AWS preferred), IAM and least-privilege design, Kubernetes and container security, network security and zero-trust access (e.g., Tailscale, mTLS), web application security (WAF, CSP, authentication/anti-abuse), security observability (SIEM/audit logging, CSPM, runtime detection), and secure SDLC/supply chain security (SAST/DAST, secret scanning, SBOM, artifact signing)
A working understanding of how AI is currently shaping the security landscape — both offensively (AI-assisted phishing, automated exploitation, LLM-specific attack surfaces) and defensively (AI-assisted detection, code review, and pentesting) — and the judgment to separate real risk and real value from hype
Demonstrated ability to go deep on a single domain when the problem demands it, and to reason credibly across all of them when setting priorities
Experience threat modeling new features and influencing engineering design decisions before code is written
Strong communication skills — able to translate security risk into terms that engineers, product managers, and leadership can act on
Comfort operating with significant autonomy in a fast-moving environment, and pulling in the right partners across the org to get things done

Nice To Haves

Experience securing multi-tenant SaaS platforms, including tenant-isolation testing or red-teaming
Relevant certifications (e.g., OSCP, GWAPT, GCSA, or similar) — nice to have, not required
Experience building or operating detection engineering programs (honeytokens, canary credentials, runtime threat detection)
Prior experience in a regulated or compliance-heavy environment (SOC 2, ISO 27001, etc.)
Hands-on experience securing AI/LLM-powered features or evaluating the security posture of AI coding tools and agentic workflows

Responsibilities

Help design and execute a multi-year application and platform security roadmap spanning cloud infrastructure, identity, network, application, observability, and the software supply chain
Harden our AWS and Kubernetes environments — from account/organization structure and IAM to workload identity, network segmentation, and zero-trust access
Strengthen authentication and application-layer defenses, including anti-abuse protections, secure headers, and multi-tenant isolation
Build out the security observability stack: audit logging, cloud posture monitoring, runtime threat detection, and deception-based detection techniques
Embed security into the SDLC — CI/CD gates, secret scanning, threat modeling, and software supply chain integrity (SBOMs, artifact signing, provenance), accounting for the new risks and review needs introduced by AI-generated code and AI-assisted development workflows
Evaluate and adopt AI-powered security tooling — from AI-assisted pentesting and code review to anomaly detection — to help our small team punch above its weight
Work closely with the security lead to prioritize this work, balancing finite hardening projects against the ongoing operational load of running a security program that scales with the company
Serve as a trusted security resource for engineering teams — reviewing designs, unblocking teams on secure implementation patterns, and helping raise security literacy across the org
Support customer and compliance conversations where deep technical credibility is needed

Benefits

Flexible Paid Time Off
10 company holidays
Health Benefits - including Medical, Dental, and Vision
HSA Match
401(k) - we match 100% up to 3% of your contribution. Eligibility is immediate with 100% vesting.
Mental Health - all employees have access to Impact Suite & to our Employee Assistance Program (EAP).
Paid New Parent Leave & Birthing Parent Leave
Supplemental Benefits - including 100% company paid Basic Life & AD&D insurance and long & short-term disability coverage.
Nectar - our peer-to-peer recognition program
Company Events - including monthly company-wide meetings, summer parties, and more.
ERG Committees - to plan initiatives around continuing education, community outreach, recruiting, onboarding, and more.
Fully-stocked kitchen