Team Lead, AppSec

Forward Financing

36d•CA$175,000 - CA$200,000•Remote

About The Position

As Team Lead, AppSec, you'll take the reins of Forward's application and product security program at a pivotal moment, as we scale our use of AI to build software faster than ever. You'll lead a team of senior engineers, modernize how we pentest and remediate vulnerabilities, and make sure security keeps pace with an engineering organization that increasingly builds with, and builds, AI agents.

Requirements

Typically has 7 or more years in application security, offensive security, or product security, including team leadership.
Hands-on pentesting and code-review depth across web applications, APIs, and cloud infrastructure (AWS).
Experience building or scaling a security testing program — scoping, tooling, cadence, and remediation SLAs.
Understanding of AI/LLM attack surface: prompt injection, insecure agent tool use, and vulnerabilities characteristic of AI-generated code.
Experience with modern programming languages such as Ruby, Python, or Go, and with secure SDLC practices.
Ability to communicate risk and priorities crisply to engineers and executives.
Typically has a Bachelor's Degree in Computer Science or equivalent technical degree, or equivalent industry experience.

Nice To Haves

Experience pentesting or red-teaming LLM applications and agentic systems.
OSCP/OSWE or comparable offensive certifications.
Experience running bug-bounty or external testing programs.
Background in fintech or other regulated environments.

Responsibilities

Lead application and product security across Forward-built, third-party, and AI-built software.
Evolve the pentest program: aggressively security-test and remediate existing software, then continuously test net-new agents and the software agents create.
Proactively build and integrate AI solutions within the appsec function.
Own remediation workflows and vulnerability management with Engineering, including pre-production vs. post-production gap analysis.
Partner with other teams to build controls to contain external exposure: network allowlists, egress proxy, and proxy-level DLP.
Support the test-to-production review process so AI-built work is security-reviewed before promotion.
Grow and develop a team of senior engineers; set quality and coverage standards for offensive testing.
Build and maintain security services within the Forward application stack.