Senior Application Security Engineer

ANVIL•Ottawa, ON

2d•CA$125,000 - CA$165,000•Hybrid

About The Position

As a Senior Application Security Engineer, you will be a cornerstone of ANVIL's security posture — reporting directly to the Director of Security Engineering and playing a key role in building out our application security program from the ground up. You will embed security practices across the software development lifecycle and provide hands-on expertise in threat modeling, penetration testing, and secure deployment architecture. ANVIL's products are primarily deployed in air-gapped, classified environments — which means the security decisions you make have real operational weight and must hold up without the safety net of perimeter-based cloud controls. You will work closely with engineering teams to ensure that security is not an afterthought but an intrinsic quality of everything we ship. Working alongside the Director of Security Engineering, you will help shape AppSec strategy, conduct architecture reviews, perform application and infrastructure penetration testing, and drive the maturation of our secure development practices. You will also serve as a subject-matter expert and trusted advisor for our customers in the defence and national security space — organizations where the consequences of a security failure are never abstract. We value people who have an ingrained sense of accountability to the team around them. As an ideal candidate, you are not only technically qualified but demonstrate a strong work ethic and take pride in your craft. You collaborate and communicate effectively with the other talented and motivated members of our organization — translating complex security risks into clear, actionable guidance for both technical and non-technical audiences. We encourage our employees to expand their horizons by developing new skills, sharing bold ideas, and taking risks. As a senior engineer, you lead by example and provide mentorship to other employees in your field of expertise. This is a full-time position based in Ottawa with up to 25% travel primarily in the National Capital Region. Eligible candidates must either possess or be eligible to obtain a Government of Canada Secret or Top Secret security clearance.

Requirements

Eligible for Government of Canada Secret or Top Secret security clearance
Bachelor's degree in Software Engineering, Computer Science, Cybersecurity, or a related technical field, or 10+ years of professional software or security engineering experience
Minimum of 7+ years of experience in application security, penetration testing, or security engineering roles
A minimum of 3+ years of hands-on experience with threat modeling methodologies (e.g., STRIDE, PASTA, LINDDUN, or Attack Trees)
A minimum of 3+ years of experience embedding security into CI/CD pipelines and secure SDLC practices
Demonstrated experience conducting application and infrastructure penetration tests and red team assessments in production or pre-production environments
Proven experience securing applications and infrastructure in air-gapped, on-premises, or classified deployment environments
Experience with GCP or equivalent cloud platform for dev/staging environment security
Expert knowledge of application security principles and secure development practices (OWASP Top 10, SANS CWE, NIST SSDF)
Expert knowledge of threat modeling techniques and architecture security review practices
Strong knowledge of penetration testing methodologies for web applications, APIs, and cloud environments
Strong knowledge of DevSecOps tooling, including SAST, DAST, SCA, container scanning, and secrets detection
Strong knowledge of security architecture for air-gapped and disconnected environments, including supply chain integrity, offline update mechanisms, and hardened OS/container baselines
Working knowledge of GCP security controls, IAM, and posture management for dev and demo environment governance
Strong knowledge of cryptographic protocols, authentication standards (OAuth 2.0, OIDC, SAML), and secure API design
Experience with container and Kubernetes security hardening
Familiarity with regulatory and compliance frameworks relevant to defence and public safety environments (e.g., ITSG-33, FedRAMP, SOC 2)
Strong analytical mindset with exceptional attention to detail
Excellent verbal and written communication skills, with the ability to clearly articulate risk and remediation strategy to both technical and non-technical audiences
Demonstrated ability to work collaboratively across development teams and with engineering leadership
Proven ability to manage multiple concurrent security initiatives and findings remediation programs

Nice To Haves

Relevant security certifications (OSCP, GWAPT, GWEB, CSSLP, CISSP, or equivalent)
Scripting and automation experience (Python, Go, Bash, Rust, or other)
Experience with red team tooling and adversary simulation frameworks (Metasploit, Cobalt Strike, Burp Suite Pro, or equivalent)
Experience with PostgreSQL, OpenSearch, and Elasticsearch security hardening
Stream processing security experience (Kafka, message brokers)
Experience with secret management platforms suited to air-gapped environments (HashiCorp Vault, OpenBoa, or equivalent on-premises solutions)
Bilingualism French/English
Experience working in or closely with defence, public safety, or national security organizations

Responsibilities

Assist the Director of Security Engineering in building and maturing ANVIL's application security program across all product lines and delivery mechanisms
Help define and enforce secure coding standards, security review gates, and developer security training initiatives
Integrate and maintain AppSec tooling (SAST, DAST, SCA, container scanning, secrets detection) within CI/CD pipelines
Establish and track security KPIs and provide regular reporting on program health to the Director of Security Engineering
Advise on and implement DevSecOps best practices across the full platform, ensuring security keeps pace with the speed of development
Lead threat modeling sessions for new and evolving system architectures using structured methodologies (STRIDE, PASTA, LUNDUN or equivalent)
Perform security architecture reviews at design and code review stages, identifying systemic risks before they reach production
Develop and maintain reusable threat libraries, security design patterns, and architecture guidance documents
Collaborate with engineering teams to validate that security controls address identified threats end-to-end
Partner with engineering leadership to incorporate security requirements into product roadmaps and sprint planning
Plan and execute application, API, network, and cloud infrastructure penetration tests against ANVIL products and customer environments
Produce clear, actionable penetration test reports with risk-rated findings and remediation guidance tailored to the audience
Manage findings through to remediation, verifying fixes and maintaining an up-to-date risk register
Simulate adversarial attack scenarios to assess detection and response capabilities and inform defensive improvements
Stay current with the evolving threat landscape, TTPs, and vulnerability research relevant to ANVIL's operational domains
Define and implement security baselines and hardening standards for air-gapped, on-premises, and appliance-based deployments — ANVIL's primary delivery mechanism for production customer environments
Harden containerized workloads (Docker, Kubernetes) for disconnected operation, including secure image distribution, offline vulnerability scanning, and supply chain integrity controls
Assess and remediate insecure configurations, excessive permissions, and network exposure risks across all deployment targets
Maintain GCP security baselines, IAM policies, and posture management controls for ANVIL's internal dev and demo environments
Collaborate with DevOps and infrastructure teams to ensure security controls are applied consistently and verifiably across all delivery mechanisms — cloud, VM, and appliance
Provide on-site support and security guidance to customers for software product provisioning, security configuration, and incident response
Participate actively in sprint planning, technical reviews, and architecture discussions as a security voice
Mentor team members on secure development practices, vulnerability research, and applied security tooling
Lead by example — demonstrating rigor, intellectual curiosity, and accountability in everything you do