Lead Application Security Engineer

Nasdaq•Toronto, ON

9d•$121,000 - $170,000•Hybrid

About The Position

As a Lead, Information Security reporting to Senior Director, Information Security, you'll serve as the primary point of contact for information security across a major cloud-based technology project. You'll play a critical role in designing and delivering secure solutions, protecting systems and applications, and supporting regulatory compliance in a fast-paced, high-impact environment. You'll thrive in this role if you're analytically rigorous, security-focused, and energized by solving complex problems across diverse platforms and global teams.

Requirements

Bachelor's degree in Computer Science, Information Systems, or a related field, or equivalent practical experience.
10+ years of experience in information security, with demonstrated expertise across on-premise and cloud-based environments.
Hands-on experience with application security tools including dynamic and static analysis and web application penetration testing.
Strong ability to assess and communicate security risks across multiple computing platforms of varying complexity.
Active holder of one or more of the following certifications: CISSP, CISA, CCSP, GIAC (GSEC, GCFW, GCIA, GCIH, GPEN, GCFA, GSLC, GSNA, GISO), or equivalent.

Nice To Haves

Experience supporting regulatory compliance in financial services or other regulated industries.
Familiarity with Google Cloud security architecture and controls.
Track record of working across matrixed, global organizations on security initiatives.

Responsibilities

Serve as the information security lead for a cloud-based technology project, partnering with cross-functional teams to deliver security-related outcomes.
Design, develop, and implement information systems security solutions, ensuring vulnerabilities are identified and effectively remediated.
Conduct security assessments — including penetration testing and ethical hacking — across complex systems, networks, and applications to evaluate and address risk.
Evaluate and validate software patches and fixes for sophisticated vulnerabilities, including injection attacks, cross-site scripting, and malicious code threats.
Prepare security risk analysis reports and contribute to response procedures that support governance and regulatory compliance requirements.