[All remote jobs](https://jobicy.com/jobs.md)[![Thumbtack logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/05/Jobicy-210503180426-842530.jpg)](https://jobicy.com/company/thumbtack.md)[Thumbtack](https://jobicy.com/company/thumbtack.md) # Application Security Engineer II Review the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move. [Apply for this job](#job-application)[View company](https://jobicy.com/company/thumbtack.md)ShareRemote from[Canada](https://jobicy.com/job-region/canada.md)SalaryCAD 118,200–152,900 / yrDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceSeniorPublished31 Oct 2026Apply before30 Nov 2026Listing views50Application actions3Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. AI Summary ## The role, at a glance. Thumbtack is hiring an Application Security Engineer II to help embed secure-by-default practices into product architectures, platforms, and developer workflows. The role focuses on identifying and remediating application risks, conducting design reviews and threat modeling, and creating reusable security tooling and documentation. The engineer will partner closely with product and engineering teams, contribute code to address vulnerabilities, and participate in incident response. Candidates need at least four years of software engineering and/or application security experience, strong OWASP knowledge, and practical expertise in authentication, authorization, secrets management, and secure design. This is a Canada-remote role limited to Ontario and British Columbia. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 4/5EasyHard ### Pace & Pressure 4/5RelaxedFast-paced ### Autonomy Level 4/5GuidedFull ownership ### Communication Load 4/5IndependentCollaborative AI insightThe role requires practical application-security judgment across evolving services, AI-enabled features, and cloud infrastructure. It combines hands-on remediation with architectural reviews and cross-functional influence, requiring strong technical depth and clear risk communication. ## Salary analysis Estimated compensation compared with the broader CA market for similar roles. Estimated job median (per year)Market rateC$135,550CA market range (per year)C$125k–C$165k0C$181.50k AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. The employer discloses expected total cash compensation of CAD 118,200–152,900 per year for candidates in Ontario and British Columbia. The annual cadence is inferred from the stated full-time professional compensation range because the posting does not explicitly state a pay period. Estimated Canadian market compensation for a mid-level application security engineer is CAD 125,000–165,000 annually; this is an AI estimate, not verified salary research. ## Core skills Skills and capabilities most closely associated with this opportunity. [Application Security](https://jobicy.com/jobs?search_keywords=Application%20Security.md)[Threat Modeling](https://jobicy.com/jobs?search_keywords=Threat%20Modeling.md)[Secure Software Design](https://jobicy.com/jobs?search_keywords=Secure%20Software%20Design.md)[OWASP Top 10](https://jobicy.com/jobs?search_keywords=OWASP%20Top%2010.md)[Vulnerability Remediation](https://jobicy.com/jobs?search_keywords=Vulnerability%20Remediation.md)[Secure Coding](https://jobicy.com/jobs?search_keywords=Secure%20Coding.md)[Authentication](https://jobicy.com/jobs?search_keywords=Authentication.md)[Authorization](https://jobicy.com/jobs?search_keywords=Authorization.md)[Secrets Management](https://jobicy.com/jobs?search_keywords=Secrets%20Management.md)[Security Architecture Review](https://jobicy.com/jobs?search_keywords=Security%20Architecture%20Review.md)[Incident Response](https://jobicy.com/jobs?search_keywords=Incident%20Response.md)[Cloud Security](https://jobicy.com/jobs?search_keywords=Cloud%20Security.md)[Risk Assessment](https://jobicy.com/jobs?search_keywords=Risk%20Assessment.md)[Technical Documentation](https://jobicy.com/jobs?search_keywords=Technical%20Documentation.md) Sample interview questionsHow would you approach threat modeling a new customer-facing feature?I would identify the system boundaries, assets, users, data flows, trust boundaries, and entry points first. I would then enumerate likely threats using a structured approach such as STRIDE, prioritize them by likelihood and impact, and work with the engineering team to define proportionate mitigations and ownership before implementation. Describe how you would handle a high-severity application vulnerability found in production. I would validate scope and exploitability, coordinate with the responsible engineering and incident-response stakeholders, and prioritize containment or mitigation. After remediation, I would verify the fix, document root cause and impact, and propose durable preventive controls such as dependency checks, secure patterns, tests, or developer guidance. What are practical ways to make secure development easier for product engineers? I would build secure defaults and reusable components for common needs such as authentication, authorization, secrets handling, and input validation. Integrating automated checks into CI/CD, providing clear remediation guidance, and offering lightweight design-review processes reduces friction while improving consistency. How do you explain a security risk to an engineering team that disagrees with its priority? I explain the concrete attack path, affected assets, likely business impact, and uncertainty rather than relying on severity labels alone. I then discuss feasible mitigation options, their delivery cost, and residual risk so the team can make a documented, risk-informed decision. How would you assess whether an authorization implementation is secure? I would review the authorization model, trust boundaries, and enforcement points to ensure checks are server-side, consistent, and based on verified identity and permissions. I would test for horizontal and vertical privilege escalation, insecure direct object references, default access, and bypasses across APIs, background jobs, and administrative workflows. Opportunity details ## About this role. ### Thumbtack helps millions of people confidently care for their homes. Thumbtack is the one app you need to take care of and improve your home — from personalized guidance to AI tools and a best-in-class hiring experience. Every day in every county of the U.S., people turn to Thumbtack to complete urgent repairs, seasonal maintenance and bigger improvements. We help homeowners know which projects to do, when to do them and who to hire from our growing community of 300,000 local service businesses. If making an impact inspires you, join us. Imagine what we’ll build together. ### About the Cybersecurity Team The Security Engineering team at Thumbtack is focused on enabling innovation at scale by making the secure path the easiest path. We believe strong security is not a blocker to velocity, but a force multiplier when it is designed into systems, platforms, and developer workflows from the start. We partner closely with Product, Engineering, Platform, and Data teams to shape system design, guide architectural decisions, and evolve Thumbtack’s security posture as the company scales. Through collaboration, automation, and thoughtful tradeoffs, we help ensure Thumbtack can ship fast, innovate boldly, and maintain customer trust. ### The Challenge As Thumbtack scales and increasingly incorporates AI-powered features into our products and internal systems, security must evolve without slowing innovation. The number of services, deployment patterns, and data flows continues to grow, and traditional approaches that rely heavily on manual reviews or after-the-fact controls do not scale to meet this need. Instead, the challenge is to design security into the system itself. This means building secure defaults, paved paths, and reusable building blocks that product and engineering teams can adopt with minimal friction. By embedding security directly into architectures, tooling, and infrastructure, we reduce cognitive load on engineers and enable teams to move quickly and confidently while meaningfully lowering risk. ### What you’ll do * Own and deliver application security work within defined projects or domains. Contribute to cross-functional security initiatives, executing clearly scoped pieces of larger efforts. * Identify, prioritize, and help remediate application security risks in partnership with engineering teams. * Apply secure-by-default patterns and approved architectures when designing or reviewing systems. * Partner with product and engineering teams to assess risk and recommend practical, risk-informed security improvements. Participate in application security design reviews and threat modeling for new and existing systems. * Write code, reviews, and documentation to address vulnerabilities and reduce recurring classes of issues. * Participate in security incident response and contribute to post-incident analysis and remediation. ### In order to be successful, you must bring * 4+ years of experience in software engineering and/or application security. * Practical experience with application security techniques such as threat modeling, secure design patterns, authentication and authorization, secrets management, and vulnerability remediation. Strong understanding of secure coding practices and common application security risks (e.g., OWASP Top 10). * Ability to assess security risks and break down complex problems, reason about tradeoffs, make sound recommendations, and deliver practical, impactful solutions with guidance when needed. * Strong sense of ownership over assigned work, with the ability to execute independently and follow through. * Clear written and verbal communication skills, including the ability to explain security issues to engineers with varying levels of security expertise. * A growth mindset and interest in learning from more senior engineers and expanding depth in both application and cloud infrastructure security over time. ### Expected salary ranges * For candidates living in Ontario and British Columbia, the expected total cash compensation (base salary + variable pay, if applicable) range for this role is currently $118,200.00 – $152,900.00. Actual offered salaries will vary and will be based on various factors, such as calibrated job level, qualifications, skills, competencies, and proficiency for the role. Thumbtack embraces diversity. We are proud to be an equal opportunity workplace and do not discriminate on the basis of sex, race, color, age, pregnancy, sexual orientation, gender identity or expression, religion, national origin, ancestry, citizenship, marital status, military or veteran status, genetic information, disability status, or any other characteristic protected by federal, provincial, state, or local law. We also will consider for employment qualified applicants with arrest and conviction records, consistent with applicable law. Thumbtack is committed to working with and providing reasonable accommodation to individuals with disabilities. If you would like to request a reasonable accommodation for a medical condition or disability during any part of the application process, please contact: [recruitingops@thumbtack.com](mailto:recruitingops@thumbtack.com). For information about how Thumbtack collects, uses, and shares personal information about job applicants, please see our [Job Applicant Privacy Policy](https://www.thumbtack.com/job-applicant-privacy-policy). We put as much craftsmanship into candidate safety as we do into the hiring experience itself. While scammers may try to impersonate our team, we’ll never ask you for money, banking info, or SSNs during hiring. [Check out our blueprint on how to spot the fakes.](https://careers.thumbtack.com/recruiting-scams) Show more [Apply now >](https://jobicy.com/jobs/158220-application-security-engineer-ii.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![ExtraHop logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/4800f505-221.jpg) ExtraHop Oct 31 New ### [Solutions Architect III](https://jobicy.com/jobs/158258-solutions-architect-iii.md) At ExtraHop, we’re on a mission to protect and empower the connected enterprise. We reveal what is happening in the very infrastructure that sustains businesses, lives, and communities, and ensure… * ![ExtraHop logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/4800f505-221.jpg) ExtraHop Oct 31 New ### [Senior Solutions Architect](https://jobicy.com/jobs/158252-senior-solutions-architect-4.md) At ExtraHop, we’re on a mission to protect and empower the connected enterprise. We reveal what is happening in the very infrastructure that sustains businesses, lives, and communities, and ensure… * ![Twilio logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/WRILS-201023175858-722503.jpg) Twilio Oct 31 New ### [Emerging Fraud Researcher](https://jobicy.com/jobs/158251-emerging-fraud-researcher.md) Who we are At Twilio, we’re shaping the future of communications, all from the comfort of our homes. We deliver innovative solutions to hundreds of thousands of businesses and empower… * ![ExtraHop logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/4800f505-221.jpg) ExtraHop Oct 31 New ### [Senior Security Solutions Architect](https://jobicy.com/jobs/158229-senior-security-solutions-architect.md) At ExtraHop, we’re on a mission to protect and empower the connected enterprise. We reveal what is happening in the very infrastructure that sustains businesses, lives, and communities, and ensure… * ![Huntress logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91eae3ae-221.jpg) Huntress Oct 31 New ### [Security Operations Analyst](https://jobicy.com/jobs/158202-security-operations-analyst-2.md) What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at… * ![Cobalt logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/7a1fbbfd-221.jpg) Cobalt Oct 31 New ### [Associate Security Researcher](https://jobicy.com/jobs/158162-associate-security-researcher.md) The Role At Cobalt, we are evolving the way we approach security research. We are looking for an Associate Security Researcher who doesn’t just want to “break things,” but who… * ![Pleo logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/b27fbed2-221.jpg) Pleo Oct 31 New ### [Staff Security Operations Engineer](https://jobicy.com/jobs/158135-staff-security-operations-engineer-2.md) About Pleo Messy spend management is tricky business. And tedious processes are a lose-lose situation for all involved, not just finance. At Pleo, we’re changing that. We build spend solutions… * ![OpenAI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2023/03/0523b13262b12c215d8009938f5c14f1.jpeg) OpenAI Oct 31 New ### [Software Engineer, Infrastructure Security](https://jobicy.com/jobs/152102-software-engineer-infrastructure-security.md) About the Team Security is at the foundation of OpenAI’s mission to ensure that artificial general intelligence benefits all of humanity. The Security team protects OpenAI’s technology, people, and products…. * ![Veeam Software logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/f7716b71-221.jpg) Veeam Software Oct 30 New ### [Field Security Advisor](https://jobicy.com/jobs/158026-field-security-advisor.md) Veeam is the Data and AI Trust Company, specializing in helping organizations ensure their data and AI are fully understood, secured, and resilient to enable the acceleration of safe AI… * ![Twilio logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/WRILS-201023175858-722503.jpg) Twilio Oct 30 New ### [Security Engineer, Incident Response](https://jobicy.com/jobs/157930-security-engineer-incident-response-2.md) Who we are At Twilio, we’re shaping the future of communications, all from the comfort of our homes. We deliver innovative solutions to hundreds of thousands of businesses and empower… [Browse all jobs](https://jobicy.com/jobs.md)