AppSec Security Specialist

Checkfront • ,

31d • Hybrid

About The Position

We are seeking an AppSec Security Specialist to support our growing security function, with a primary focus on application security, vulnerability management, and secure development practices across Checkfront and our sister brands. This is a hybrid security role that combines hands-on application security work with security operations support. You will help identify and remediate risks across our web applications, APIs, cloud environments, and development workflows, while also supporting key security tools across endpoint protection, DLP, SIEM, SOAR, vulnerability management, and security awareness. This role is ideal for someone who enjoys working with engineering teams, performing web application security scans, coordinating penetration testing activities, investigating security alerts, tracking remediation, and helping the business improve its overall security posture.

Requirements

• 4+ years of experience in application security, security operations, IT security, vulnerability management, or a related field.
• Experience with web application security testing, vulnerability scanning, remediation tracking, or secure software development practices.
• Experience with security tools such as EDR, DLP, SIEM, SOAR, vulnerability management, web application scanning, or security awareness platforms.
• Ability to investigate security alerts, document findings, and escalate issues appropriately.
• Ability to work with engineering and IT teams to validate findings, track remediation, and reduce risk.
• Strong attention to detail and the ability to track findings, risks, and remediation items through to completion.
• Strong written and verbal communication skills with both technical and non-technical audiences.
• Comfort working in a fast-moving SaaS environment with multiple brands, systems, and stakeholders.
• A practical, curious, and ownership-driven approach to security.

Nice To Haves

• Familiarity with CrowdStrike, KnowBe4, vulnerability scanners, ticketing systems, web application scanning tools, and GRC platforms is an asset.
• Working knowledge of security and compliance frameworks such as SOC 2, ISO 27001, PCI DSS, GDPR, or similar standards.
• Experience supporting audit preparation, evidence collection, control testing, or ongoing compliance tracking.
• Experience supporting customer security questionnaires, vendor risk assessments, due diligence requests, or RFP security responses.
• Experience supporting SaaS, fintech, travel technology, or other regulated technology environments.
• Familiarity with cloud platforms, secure software development practices, and infrastructure security.
• Experience coordinating external penetration tests or working with third-party security vendors.
• Certifications such as CISSP, Security+, CSSLP, or similar are an asset.
• Experience with privacy, data protection, or AI governance requirements is an asset.

Responsibilities

• Support application security across Checkfront, Rezdy, Regiondo, and related platforms.
• Perform web application security scans and help validate, prioritize, and track findings through remediation.
• Support vulnerability management processes, including scanning, prioritization, reporting, and remediation tracking.
• Use and support application security tools such as SAST, DAST, SCA, and manage security findings.
• Coordinate with penetration testing vendors, including scoping, scheduling, evidence collection, findings review, and remediation follow-up.
• Work with engineering/dev teams to validate security findings, reduce risk, and improve secure development practices.
• Help identify and reduce risk across web applications, APIs, cloud services, and third-party components.
• Support secure software development practices, including clear guidance on remediation, secure coding, and risk reduction.
• Support day-to-day security operations across endpoint protection, DLP, SIEM, SOAR, and vulnerability management tools.
• Monitor and triage security alerts from tools such as CrowdStrike and related security platforms.
• Assist with incident response activities, including investigation, documentation, escalation, and follow-up actions.
• Help tune alerts, workflows, automations, and reporting to reduce noise and improve security visibility.
• Support security logging, monitoring, and detection improvement initiatives.
• Manage and support the KnowBe4 security awareness platform.
• Coordinate phishing simulations, training campaigns, reporting, and follow-up actions.
• Help improve employee security awareness through clear communication, practical guidance, and targeted training.
• Track training completion and support reporting related to security education.
• Partner with security, IT, engineering, legal, privacy, and business teams to support security outcomes.
• Translate security requirements into clear, actionable tasks.
• Communicate findings, risks, and remediation needs to both technical and non-technical stakeholders.
• Help build a security culture focused on ownership, transparency, and continuous improvement.

Benefits

• High trust, high impact: We give our people the autonomy to take ownership, solve problems, and make meaningful contributions.
• Curiosity is encouraged: We value learning, asking questions, and pushing boundaries, not just getting things done, but doing them better.
• Collaboration over ego: We work as one team across geographies and brands. Success is shared, and support is a given.
• Space to grow: Whether you’re deepening your security skills, expanding into compliance, or learning new tools, you’ll be backed to grow.
• Progress over perfection: We embrace change, move quickly, and are constantly iterating to improve how we work and what we deliver.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed