3 days ago
Toronto, CanadaMid Level
Responsibilities
- Lead and execute application security testing across the organization’s product suite.
- Collaborate with development and product teams to design secure application architectures.
- Perform security-focused code reviews to identify flaws, coding errors, and attack vectors.
- Conduct penetration testing, threat modeling, and vulnerability assessments.
- Guide vulnerability management, remediation tracking, and risk-management processes.
- Advise developers and stakeholders on secure coding, security standards, and emerging threats.
- Maintain application security KPI reports, metrics, architecture documentation, and security guidelines.
- Partner with development and DevOps teams to automate security tests and guardrails in CI/CD pipelines.
- Evaluate security tools and technologies and maintain expertise in emerging vulnerabilities and attack techniques.
Requirements
- Ideally 3+ years of hands-on application security engineering, penetration testing, and security code review experience.
- Deep knowledge of OWASP Top 10, CWE Top 25, secure coding, and secure development lifecycles.
- Understanding of CI/CD environments, web application security, cloud security, and microservices architectures.
- Strong knowledge of HTTP, WebSockets, SQL, JSON, and Protobufs.
- Proficiency in C++, C#, Python, or JavaScript sufficient for secure code review.
- Working knowledge of cryptographic protocols and TLS implementations.
- Experience interpreting vulnerability scanning and penetration testing results; penetration-testing methodology knowledge is a plus.
- Knowledge of CNAPP, Docker, Kubernetes, AWS Lambda, network protocols, firewall configurations, and web protocols.
- Expert-level use of Burp Suite Professional, browser developer tools, SQLmap, Wireshark, CSPM, and SAST/DAST tools.
- Strong written and verbal communication skills and the ability to balance security risk with delivery needs.
- Desirable certifications include SANS GXPN, OSCP, OSWE, CISSP, OSCE, OSEE, and CCSAS.
Benefits
- Cloud-first hybrid workstyle with flexibility and balance.
- Generous time off and leave programs.
- Opportunities to work with emerging technology, innovation, digital finance, and mission-critical global-market systems.
- Employee-led Team Impact initiatives supporting social good.
- Supportive leadership, wellness programs, career growth, and a collegial and inclusive work environment.
Tech Stack
Categories
About TMX Group
TMX Group operates Canada’s primary market infrastructure, including Toronto Stock Exchange, TSX Venture Exchange, and Montréal Exchange, plus clearing and depository services (CDCC, CDS) and market data units. It serves issuers, investors, brokers, and energy traders with listing, trading, clearing, data, and analytics, and earns fees from transactions, listings, data subscriptions, and technology platforms like Trayport. Headquartered in Toronto, TMX Group is a public company listed on the TSX.