Senior Security Engineer Application & Product Security

unlimited holidays - extra parental leave - work from anywhere
Work set-up: 
Full Remote
Contract: 
Full time
Experience: 
Senior (5-10 years)
Work from: 
Canada

Offer summary

Qualifications:

7+ years of experience in security engineering or related roles., 4+ years of specialized experience in web application, API, and product security., Deep expertise in securing multi-tenant SaaS platforms., Proficiency in conducting penetration tests, code reviews, and vulnerability assessments..

Key responsibilities:

  • Conduct threat modeling and architecture reviews to enable secure designs.
  • Perform penetration testing and vulnerability assessments on web applications and APIs.
  • Integrate security practices into the software development lifecycle and manage security tooling.
  • Lead incident response and support compliance efforts for security standards.

CaptivateIQ logo
CaptivateIQ Scaleup https://www.captivateiq.com
201 - 500 Employees
See all jobs

Job description

CaptivateIQ is the leading Sales Performance Management solution, recognized by Forrester and G2, and trusted by customers including Affirm, Gong, and Figma. With solutions for Sales Planning and Incentives, we help revenue teams automate processes, hit revenue targets, and adapt with business change, ultimately driving efficient growth. Its time to rethink ROI your return on incentives with CaptivateIQ.

With backing from Sequoia, Accel, ICONIQ, Sapphire Ventures, and other leading investors, CaptivateIQ is on a mission to enable every company to improve their return on incentives and sales planning.

Come and see why Glassdoor and Comparably have recognized CaptivateIQ as a best place to work!

About the role:
Security is a core value at CaptivateIQ. As we scale and expand our suite of services, embedding security into every phase of product development is critical to building trust in everything we deliver.

As a Senior Security Engineer focused on Application & Product Security, you will own our AppSec strategy driving threat modeling, secure architecture design, and offensive security testing. You will lead manual and automated penetration testing, manage AppSec tooling (SAST, DAST, SCA), and build developer enablement programs. You’ll also be responsible for vulnerability management, incident response for applicationlayer events, and ensuring compliance alignment for SOC 2, ISO 27001, and privacy requirements.

This role blends offensive and defensive expertise with strategic influence, giving you the autonomy to shape a scalable, modern AppSec program.

Responsibilities:
  • Threat Modeling & Architecture Reviews Mature and scale a modern threat modeling program across products and services. Enable secure by design architectures in collaboration with Engineering teams.
  • Offensive Security Testing Conduct penetration tests (whitebox and blackbox) for web applications and APIs. Perform dynamic (DAST), static (SAST), and software composition (SCA) analysis. Simulate adversary attack scenarios to validate controls and identify gaps.
  • Secure SDLC Integration Embed security into every stage of development; implement automated security tooling in CICD pipelines.
  • Vulnerability Management Triage and prioritize applicationlayer vulnerabilities and guide engineering teams through remediation.
  • Developer Enablement Deliver secure development and coding training; create resources to reduce recurring vulnerabilities.
  • Bug Bounty Management Oversee Bug Bounty program, validate findings, and ensure timely resolution.
  • Incident Response Leadership Lead investigations for applicationlayer security incidents and conduct postincident analysis.
  • Compliance Enablement Support audits, technical evidence collection, and control design for SOC 2, ISO 27001, and privacybydesign requirements.
  • Customer TrustContribute to customer security assessments, penetration test reports, and security documentation.

  • Requirements:
  • 7+ years of experience in a security engineer or related role, including 4+ years specializing in web application, API, and product security.
  • Deep expertise securing multitenant SaaS platforms and features.
  • Strong communication and ability to influence software engineers and product managers.
  • Advanced experience conducting penetration tests, code reviews, and vulnerability assessments.
  • Expert knowledge of OWASP Top 10, web application and API security, and common vulnerability classes with practical remediation strategies.
  • Handson experience with AppSec tooling (SAST, DAST, SCA) integrated into CICD pipelines.
  • Strong programming and scripting skills (Python preferred) and ability to influence secure coding practices.
  • Proven ability to lead incident response for applicationlayer security events.
  • Familiarity with compliance frameworks (SOC 2, ISO 27001) and secure SDLC practices.
  • Knowledge of privacybydesign principles and data security in SaaS environments.
  • Awareness of emerging AIML security risks and related countermeasures.


  • Nice to have:
  • Certifications such as OSCP, GCIH, GWAPT, or CISSP.
  • Familiarity with security frameworks such as NIST CSF, MITRE ATT&CK, OWASP ASVS, or ISO 27001.
  • Experience with commercial security tools such as EDR, SIEM, CSPM, CNAPP, vulnerability scanners, bug bounty platforms, WAFs, or compliance automation platforms.
  • Prior experience driving security engineering for a SaaSbased company.
  • Experience leveraging automation or AIML tools to improve secure development, detection, incident response, or code analysis workflows.

  • Benefits:
  • (USONLY) 100% of medical, dental, and vision covered including 75% for dependents
  • Flexible vacation days and quarterly mental health days so you can recharge
  • Enjoy a onetime expense on your 1year work anniversary (to use for travel, home furnishings, fancy meal)
  • (USONLY) 401k plan to participate in and save towards the future
  • Newest Apple products to help you do your best work
  • Employee Resource Groups (ERGs) to support and celebrate the shared identities and life experiences of communities within CaptivateIQ. ERGs directly support our companywide DEI goals as a space for developing and retaining diverse talent

  • Notice to Prospective Candidates:
  • Only emails from @captivateiq.com should be trusted.
  • We are aware of active recruitment scams using the CaptivateIQ name, in which individuals pose as our recruiters and post fake remote job openings and make fake job offers on the Internet. Please note, we will never do the following:
  • Attempt to correspond with a candidate using a free webbased account, such as an email address that ends in @gmail.com, @yahoo.com, @hotmail.com, etc.
  • Make an offer of employment without conducting multiple rounds of interviews facetoface using secure videoconferencing technology.
  • Ask candidates to cash checks to buy equipment on behalf of CaptivateIQ.
  • Ask candidates to make a payment in order to be considered for a position.
  • Make early requests for candidates personal information such as date of birth, passport details, credit card numbers, bank details and social security number, etc.
  • Please note that we’ll only ask for more sensitive personal information in connection with background checks after an offer is made.
  • Participate in an oncall rotation to provide afterhours support, ensuring timely resolution of critical issues and maintaining system uptime.
  • CaptivateIQ participates in EVerify, webbased system that allows enrolled employers to confirm the eligibility of their employees to work in the United States
    •

    Required profile

    Experience

    Level of experience: Senior (5-10 years)
    Spoken language(s):
    English
    Check out the description to know which languages are mandatory.

    Hard Skills

    Threat ModelingPenetration TestingApplication SecurityVulnerability ManagementSoftware SecurityScriptingComputer ProgrammingSecurity TestingIncident ResponseArtificial Intelligence

    Other Skills

    • Communication
    • Leadership
    Are you interested?

    Security Engineer Related jobs

    See more Security Engineer jobs