Senior Application Security Engineer
A senior application security engineer at Nutrien in Calgary who embeds security across the software development lifecycle — leading vulnerability identification, prioritization, and remediation while partnering with development, DevOps, and cyber security teams. Core work involves tools like Qualys, Tenable, Snyk, risk frameworks (OWASP, NIST, CVSSv4), mentoring, and acting as a technical escalat
- Compensation
- Not disclosed
- Location
- Not listed
- Work setup
- Not specified
- Seniority
- Senior
- Employment
- Not specified
- Experience
- 6+ years
- Category
- Security
- Posted
Skills
Must have
- Minimum 6-8 years of related experience
- Strong understanding of the vulnerability management lifecycle, governance, and risk-based prioritization in enterprise environments
- Deep familiarity with application security and risk frameworks (ISO 27001-2, ISO 31000, PCI DSS, OWASP ASVS, NIST, ITIL, COBIT, CVSSv4, MITRE ATT&CK)
- Hands-on experience with vulnerability management tools such as Qualys, Tenable, Snyk, and TruffleHog Pro
- Experience working in Agile development environments
- Strong understanding of operating systems (Windows, Unix, MacOS), cloud concepts (secure build images, ephemeral workloads, cloud patching), and networking fundamentals
- Strong application development background with full-stack and mobile development across iOS and Android
- Experience developing metrics, dashboards, and risk reporting for technical teams and leadership
- Experience with API security scanning and application security testing approaches
- Broad knowledge of cyber security practices including secure configuration management, data protection and privacy, security monitoring, incident response, GRC, patch management, and enterprise securi
- Strong written and verbal communication skills with ability to influence senior management, technical SMEs, and cross-functional stakeholders
- Demonstrated ability to examine issues strategically and analytically, balancing technical depth with practical business outcomes
- Advanced understanding of the use of AI in application development
Nice to have
- Bachelor's degree in Computer Science, Information Systems, Engineering, Business, or a related field
Full description
##
This Sr. Level role is to help development teams build and run software more securely without slowing them down. This role is part of the application security team and works across application development, DevOps, and cyber security to help teams work through vulnerabilities, improve day-to-day security practices, and make better decisions about where to focus on the cyber risk areas. It is also a senior role on the team, so there is an expectation to mentor others, provide practical guidance, and step in when leadership support is needed.
The value of the role is that it helps turn security from something teams react to into something that is built into how they work. For the team, that means clearer direction, stronger technical support, and better follow-through on the issues that matter most. For the business, it means reducing avoidable risk, improving consistency across application security work, and giving leadership confidence that security issues are being managed in a practical and accountable way.
The Role:
The Senior Application Security Engineer is a senior technical role responsible for advancing security across the software development lifecycle (SDLC). Working closely with application development, DevOps, cyber security, and IT teams, this position leads the identification, assessment, prioritization, and remediation of vulnerabilities across code, infrastructure, and applications, while providing technical direction on secure development practices, automation, and risk reduction.
This role serves as a trusted technical leader and escalation point for application and vulnerability management matters, partnering across teams to drive remediation, influence technical decisions, and support consistent execution across multiple initiatives. The successful candidate will bring strong technical depth, sound judgment, and a strong application development background, along with the ability to provide leadership continuity and decision support when the manager is out of office.
What You'll Do:
- Build strong relationships across application development, DevOps, cyber security, and IT teams to influence secure development outcomes and provide expert technical guidance
- Lead vulnerability management activities, including prioritization, risk evaluation, progress tracking, and stakeholder communication
- Monitor emerging business, technology, and cyber security trends and translate insights into practical improvements for development teams
- Partner with engineering and DevOps teams to evaluate, implement, and optimize vulnerability management capabilities across people, process, and technology
- Own and enhance key components of vulnerability management and application security solutions in complex enterprise environments