[Hiring] Staff Application Security Specialist @Workleap - en

Role Description

You will build the security layer for how Workleap writes software, and then you will teach it to run itself.

• Implement traditional stack security: SAST, DAST, SCA, and secret scanning wired into GitHub Actions.
• Conduct threat modeling on architectural changes.
• Manage vulnerability intake and triage to close the loop instead of filling a backlog.
• Move toward agentic security review, where agents perform the first pass on every pull request.
• Close the gap between rules engines and models to enhance security.
• Write the code as a hands-on individual contributor.

Your Impact

• Build security guardrails for AI-assisted and agentic development.
• Automate security review to reduce human bottlenecks.
• Achieve near-zero developer friction on security signals.
• Lead threat modeling on new features and architectural changes.
• Drive remediation of application security vulnerabilities.
• Harden Azure environments and deployment patterns alongside Infrastructure SecOps.

Your Team

You will join LeapSec and report to the Director of Infrastructure and Security. The team covers product security, cloud security, and governance across Workleap and ShareGate.

• Work ships and you own it end to end.
• Set priorities that matter with real scope and autonomy.
• Partner closely with the AI SDLC team and product engineering across the organization.

Qualifications

• Five or more years in application security, DevSecOps, or security-focused software development.
• Deep working knowledge of web application security, OWASP Top 10, and CWE Top 25.
• Proven experience building security automation into CI/CD pipelines, GitHub Actions preferred.
• Built and shipped real agent tooling, not just used it.
• Context engineering as a discipline.
• Understanding of the security model of agentic systems.
• Proficiency in Python for building tooling.
• Hands-on experience with AI-assisted and agentic development workflows.
• Solid grasp of Azure services, infrastructure security, and deployment patterns.
• Ability to explain a risk tradeoff to both engineers and executives.

Strong Assets

• Secure code review experience in C#/.NET.
• Experience integrating SAST, DAST, SCA, and secret scanning at scale.
• Familiarity with OIDC, SAML, and OAuth.
• Exposure to SOC2 requirements.
• Experience running vulnerability discovery and triage with a developer community.

Benefits

• Annual bonus program.
• LTIP program, share in Workleap's long-term growth.
• RRSP + Family health insurance + telemedicine + annual wellness budget.
• Flexible vacation policy.
• Remote work, with access to our Montreal office.
• In-person gathering twice a year.
• Claude access for everyone.

What Drives Us

At Workleap, we build software that sits at the center of how people experience work, every day, at every level.

• We move fast, iterate, and make decisions with available information.
• We are builders who use AI to enhance our toolkit.
• If you want real impact and a place where your decisions matter, this is it.

How We Hire

Transparency is how we hire — for you as much as for us.

• First call with a recruiter.
• Virtual interview with the hiring manager.
• Complete a take-home case study.
• Meet with future colleagues to discuss the case study.
• AI supports certain steps, but every hiring decision remains human.