[All remote jobs](https://jobicy.com/jobs.md)[![Lightspeed Commerce logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/09/3d38005a-221.png)](https://jobicy.com/company/lightspeed-commerce.md)[Lightspeed Commerce](https://jobicy.com/company/lightspeed-commerce.md) # Senior Engineer, Application Security AI Summary Lightspeed is seeking a senior Application Security Engineer to embed Secure by Design practices throughout software delivery workflows. The role focuses on threat modeling, security automation, vulnerability remediation, and tuning SAST, DAST, SCA, secrets, and LLM scanning tools. The engineer will partner with developers, platform teams, and vulnerability operations to reduce security friction while strengthening CI/CD guardrails. Responsibilities also include providing remediation guidance and leading developer security enablement through a Security Champions program. This is a high-impact technical role in a fast-paced cloud-commerce environment.[Apply for this job](#job-application)[View company](https://jobicy.com/company/lightspeed-commerce.md)ShareRemote from[Canada](https://jobicy.com/job-region/canada.md)SalaryUndisclosedDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceSeniorPublished3 Nov 2026Apply before3 Dec 2026Listing views39Application actions1Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. Opportunity details ## About this role. Hi there! Thanks for stopping by 👋 Are you actively looking for a new opportunity? Or just checking the market? Well… you might just be in the right place! As a Senior Application Security Engineer, you will serve as a foundational anchor on the AppSec team, leading our strategic shift hard-left toward developer-embedded security and Secure by Design operationalization. You will design, build, and scale state-of-the-art AppSec practices while collaborating closely with Vulnerability Operations to streamline vulnerability triage and remediation. Leveraging cutting-edge AI-assisted workflows and modern automation, you will eliminate friction for developers, burn down legacy risks, and fortify software lifecycles against sophisticated, emerging threat vectors. What you’ll be doing: * Operationalize Secure by Design principles end-to-end, embedding seamless security controls directly into feature designs, pull requests, IaC checks, and daily engineering workflows. * Architect high-impact feature and infrastructure threat models, validating and enhancing advanced AI-generated threat modeling pipelines. * Configure, fine-tune, and orchestrate SAST, DAST, SCA, Secrets, and LLM scanner rulesets to eliminate false positives and streamline Vulnerability Operations. * Build and stabilize new AppSec processes and ways of working while ensuring legacy security controls remain fully active. * Pioneer AI-driven automation to dramatically accelerate vulnerability triage and remediation, systematically burning down security backlogs. * Provide hands-on technical fix guidance to developers for complex structural flaws and web application vulnerabilities. * Drive developer security enablement across the organization—championing our Security Champions program and delivering engaging, impactful secure coding workshops. * Partner closely with Platform and Infrastructure Security teams to build frictionless, automated guardrails into CI/CD pipelines. What you need to bring: * Deep, hands-on experience in Application Security, Product Security, or Secure Software Engineering in high-growth cloud environments. * Bachelor’s degree in Computer Science, Cybersecurity, or Software Engineering, or equivalent practical experience. * Deep understanding of web application vulnerabilities (OWASP Top 10), business logic flaws, and secure coding practices. * Proven track record tuning SAST, DAST, SCA, Secrets, and LLM scanner pipelines in CI/CD environments. * Demonstrated experience with threat modeling methodologies, Secure by Design principles, and guiding developers through code remediations. * Proven experience leveraging AI/LLM tools to automate security analyses, accelerate triage, and optimize developer security workflows. * Fluency in modern software development languages (e.g., Python, Go, JavaScript/TypeScript, Java). * Excellent cross-functional influence and communication skills to effectively lead the Security Champions program. What’s in it for you: * Join a growing team and help us move to the next level * Amazing benefits & perks, including equity for all Lightspeeders * Constant development of both your skill-set and business acumen with limitless growth opportunities * Lots of autonomy, flexible work culture * Innovation time to explore and learn at work * Shaping the company by joining cultural & technical committees * Tons of growth opportunities into technical or people management roles * Opportunity to join a fast-paced, high-growth company * Opportunity to learn, expand your skill set, forge wonderful relationships and make your mark within the diverse and inclusive Lightspeed family, a true Canadian tech success story …. And enjoy a range of benefits that will keep you happy, healthy and (not) hungry. * Lightspeed equity scheme (we are all owners). * Flexible paid time off and remote work policies. * Health insurance. * Contributions to your pension plan – RRSP. * Health and wellness benefit of $500 per year. * Paid leave and assistance for new parents. * Mental health online platform and counseling & coaching services. * Training opportunities to grow your skills and career * Volunteer day. * Fully stacked kitchen (hot and cold beverages, meals served) * Happy hours to build your relationships with colleagues after work Fuel your growth. Find your people. At Lightspeed, your growth is our priority. We invest in you with continuous learning opportunities, global mobility and benefits designed to support you—all within a driven, diverse and inclusive team that’s passionate about empowering our communities Please note that we ask applicants to disclose any criminal convictions, and we conduct criminal record checks as part of our hiring process for this role. To all recruitment agencies: Lightspeed does not accept unsolicited agency resumes. If we have not directly engaged your company in writing to supply candidates for a specific vacancy, Lightspeed will not be responsible for any fees related to unsolicited resumes. Lightspeed is a proud equal opportunity employer and we are committed to creating an inclusive and barrier-free workplace. Lightspeed welcomes and encourages applications from people with disabilities. Accommodations are available on request for candidates taking part in all aspects of the selection process. ### Where to from here? Obviously, this has to be mutually beneficial: we want you to step into a role you love, and we want to offer you a place you’re proud to come to every day. For a glimpse into our world check out our [career page here](https://www.lightspeedhq.com/careers/). Lightspeed is building communities through commerce, and we need people from all backgrounds and lived experiences to do that. We were founded in 2005, in Montreal’s gay village and our original members were all part of the LGBTQ+ community. The ethos of our business has been about inclusion from the very beginning, and we strive to provide a workplace where everyone belongs. ### Who we are: Powering the businesses that are the backbone of the global economy, Lightspeed’s one-stop commerce platform helps merchants innovate to simplify, scale, and provide exceptional customer experiences. Our cloud commerce solution transforms and unifies online and physical operations, multichannel sales, expansion to new locations, global payments, financial solutions, and connection to supplier networks. Founded in Montréal, Canada in 2005, Lightspeed is dual-listed on the New York Stock Exchange (NYSE: LSPD) and Toronto Stock Exchange (TSX: LSPD). With teams across North America, Europe, and Asia Pacific, the company serves retail, hospitality, and golf businesses in over 100 countries. Lightspeed handles your information in accordance with our [Applicant Privacy Statement](https://www.lightspeedhq.com/legal/applicant-privacy-statement/). Show more [Apply now >](https://jobicy.com/jobs/158761-senior-engineer-application-security.md) > Annual salary information is not provided for this position. Explore salary ranges for similar roles in our [Salary Directory ›](https://jobicy.com/salaries.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 4/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThe position requires deep hands-on application-security expertise across secure development, cloud environments, CI/CD tooling, threat modeling, and AI-assisted security workflows. It also demands organizational influence and the ability to guide engineers through complex remediation decisions. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$165,000US market range (per year)$140k–$195k0$214.50k AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. No employer salary was disclosed. The yearly cadence is inferred from this full-time senior engineering role, and the figures are estimated USD annual market compensation for a comparable senior application security position. ## Core skills Skills and capabilities most closely associated with this opportunity. [Application Security](https://jobicy.com/jobs?search_keywords=Application%20Security.md)[Secure by Design](https://jobicy.com/jobs?search_keywords=Secure%20by%20Design.md)[Threat Modeling](https://jobicy.com/jobs?search_keywords=Threat%20Modeling.md)[SAST](https://jobicy.com/jobs?search_keywords=SAST.md)[DAST](https://jobicy.com/jobs?search_keywords=DAST.md)[Software Composition Analysis](https://jobicy.com/jobs?search_keywords=Software%20Composition%20Analysis.md)[Secrets Scanning](https://jobicy.com/jobs?search_keywords=Secrets%20Scanning.md)[CI/CD Security](https://jobicy.com/jobs?search_keywords=CICD%20Security.md)[OWASP Top 10](https://jobicy.com/jobs?search_keywords=OWASP%20Top%2010.md)[Secure Coding](https://jobicy.com/jobs?search_keywords=Secure%20Coding.md)[Vulnerability Management](https://jobicy.com/jobs?search_keywords=Vulnerability%20Management.md)[AI Security Automation](https://jobicy.com/jobs?search_keywords=AI%20Security%20Automation.md)[Python](https://jobicy.com/jobs?search_keywords=Python.md)[Security Champions Program](https://jobicy.com/jobs?search_keywords=Security%20Champions%20Program.md) Sample interview questionsHow would you embed Secure by Design principles into a product development lifecycle?I would introduce lightweight security requirements during design, use threat modeling for higher-risk changes, automate relevant checks in pull requests and CI/CD, and provide actionable remediation guidance. I would also measure recurring issues and feed those lessons into secure coding standards and developer training. How do you reduce false positives from SAST, DAST, and SCA tooling without weakening security coverage? I start by validating findings against the application context, then tune rules, severities, exclusions, and ownership workflows based on evidence. Changes should be documented, reviewed regularly, and paired with metrics so that noise declines without hiding meaningful risk. Describe your approach to threat modeling a new cloud-based feature. I identify assets, trust boundaries, data flows, entry points, abuse cases, and relevant attacker capabilities. I work with engineering and product stakeholders to prioritize mitigations, convert them into implementation tasks, and verify that controls are covered by design, code, and deployment checks. How would you use AI or LLM tools in vulnerability triage responsibly? I would use AI to summarize findings, correlate evidence, suggest likely ownership, and draft remediation guidance, while keeping human review for security decisions. Inputs must be governed to avoid exposing sensitive code or data, and outputs should be validated against source evidence and established security policies. How would you build an effective Security Champions program? I would recruit respected engineers across teams, give them clear responsibilities and practical training, and provide office hours, reusable guidance, and direct access to security specialists. Success should be measured through earlier issue discovery, faster remediation, increased adoption of secure patterns, and champion feedback. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Liftoff logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/c47aea9f-221.png) Liftoff Nov 3 New ### [Application Security Engineer, Generative AI](https://jobicy.com/jobs/158817-application-security-engineer-generative-ai.md) Liftoff is a leading AI-powered performance marketing platform for the mobile app economy. Our end-to-end technology stack helps app marketers acquire and retain high-value users, while enabling publishers to maximize… * ![Chainguard logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e4b6aacf-221.jpeg) Chainguard Nov 3 New ### [Security Analyst (Governance and Trust)](https://jobicy.com/jobs/158783-security-analyst-governance-and-trust.md) Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations… * ![Tenable logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/01879e02-221.jpg) Tenable Nov 3 New ### [Senior Enterprise Security Engineer](https://jobicy.com/jobs/158725-senior-enterprise-security-engineer.md) Who is Tenable? Tenable® is the Exposure Management company. Over 40,000 organizations around the globe rely on Tenable to understand and reduce cyber risk. Our global employees support 65 percent… * ![Chainguard logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e4b6aacf-221.jpeg) Chainguard Nov 3 New ### [GRC Analyst (EMEA)](https://jobicy.com/jobs/158638-grc-analyst-emea.md) Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations… * ![GitLab logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/12/WRILS-201207055737-109952.jpg) GitLab Nov 3 New ### [Staff Software Engineer, Security Factory: Static Analysis](https://jobicy.com/jobs/158635-staff-software-engineer-security-factory-static-analysis.md) GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50… * ![TRM Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/34aa038c-221.png) TRM Labs Nov 3 New ### [Global Investigator (EMEA)](https://jobicy.com/jobs/158617-global-investigator-emea.md) Build a Safer World. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM’s platforms enable investigators to trace illicit activity, build… * ![GitLab logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/12/WRILS-201207055737-109952.jpg) GitLab Nov 2 New ### [Staff Product Security Architect](https://jobicy.com/jobs/158551-staff-product-security-architect.md) GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50… * ![Monzo logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/5b4c0ec3-221.jpg) Monzo Nov 2 New ### [Information Security Manager](https://jobicy.com/jobs/158542-information-security-manager.md) 🚀 We’re on a mission to make money work for everyone. We’re waving goodbye to the complicated and confusing ways of traditional banking. After starting as a prepaid card, our… * ![Harness logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2022/01/3b1ed4078f521827fd4fd3f1ead4e484.jpg) Harness Nov 2 New ### [Staff Security Analyst – GRC](https://jobicy.com/jobs/158473-staff-security-analyst-grc.md) Harness is the AI Software Delivery Platform company, led by technologist and entrepreneur Jyoti Bansal (founder of AppDynamics, acquired by Cisco for $3.7B). Harness has raised approximately $570M in funding… * ![Reddit logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/Reddit.jpg) Reddit Nov 2 New ### [Staff Product Security Engineer](https://jobicy.com/jobs/152256-staff-product-security-engineer.md) Reddit is a community of communities. It’s built on shared interests, passion, and trust, and is home to the most open and authentic conversations on the internet. Every day, Reddit… [Browse all jobs](https://jobicy.com/jobs.md)