Senior Application Security Engineer
Accelerant2 days ago
Remote, CanadaSenior
Responsibilities
- Own and improve application security practices across web applications, APIs, services, and software delivery workflows.
- Manage external penetration testing programs, including planning, vendor coordination, findings review, remediation tracking, and retesting.
- Partner with development squads to prioritize and close Critical and High vulnerabilities and other application security findings.
- Build vulnerability remediation processes using security AI agents and automation.
- Operate and improve SAST, DAST, SCA, container, secrets, and vulnerability-scanning capabilities.
- Maintain WAF policies, API security policies, filtering, rate limiting, and application perimeter protections.
- Support threat modeling, secure design reviews, vulnerability assessments, incident response, and secure coding practices.
- Gather and maintain security evidence for ISO 27001, SOX, and SOC 1/2 requirements.
- Provide security guidance, documentation, reporting, and education to technical teams.
Requirements
- 5+ years of experience in application security, product security, DevSecOps, or a related discipline.
- Strong understanding of web application and API security, authentication, authorization, sessions, common attack patterns, and the OWASP Top 10.
- Experience managing external penetration testing or similar third-party security assessment programs.
- Experience with vulnerability-management and security-scanning tools such as Snyk, Qualys, Trivy, Dependabot, and GitHub Advanced Security.
- Experience integrating security controls into CI/CD pipelines and development workflows.
- Experience with WAF policy management, API security, virtual patching, filtering, rate limiting, and application perimeter protection.
- Practical experience with cloud security, preferably AWS and Kubernetes/EKS.
- Experience with security automation, scripting, or programming, preferably Python.
- Strong communication and relationship-management skills when working with developers, vendors, and control owners.
- Preferred experience with AI-enabled security tooling or automation, Cloudflare Zero Trust, and Cloudflare Edge.
- OSCP, OSCP+, or an equivalent security certification is preferred.
Tech Stack
Categories
About Accelerant
Accelerant builds a data-driven risk exchange for specialty insurance, connecting MGAs and underwriters with aligned risk capital and software to run their programs. Its platform ingests and analyzes underwriting and claims data to support pricing, capacity allocation, and operations, and it partners closely with specialty underwriting teams. Founded in 2018 and headquartered in Atlanta, the company focuses on improving efficiency and profitability for program-based insurance businesses.