Application Security Engineer (senior - principal) Landmark (Calgary, AB, CA, T2P 3V4)

Responsibilities Perform application security assessments and analyze potential vulnerabilities across web applications, APIs, cloud services, and enterprise software.
Review results from static application security testing, dynamic application security testing, software composition analysis, and related security tools.
Validate findings, assess exploitability and business impact, identify potential attack paths, and help prioritize remediation.
Work directly with software engineers to explain identified risks, recommend practical corrective actions, and track vulnerabilities through resolution.
Support the integration and operation of security controls within CI/CD pipelines and software development workflows.
Contribute application security requirements and guidance throughout the software development lifecycle.
Review application architectures, designs, features, and technical changes for common security weaknesses and potential misuse scenarios.
Retest remediated vulnerabilities and document whether corrective actions adequately address the identified risk.
Support secure cloud application deployments by reviewing relevant identity, access, logging, networking, configuration, and data-protection controls.
Help identify risks in open-source components, third-party dependencies, build artifacts, and other parts of the software supply chain.
Document assessment results, remediation guidance, risk decisions, and security metrics clearly for technical and business stakeholders.
Qualifications Required Undergraduate degree in Computer Science or a related field.
A minimum of three years of experience in software development, Application Security, Cybersecurity, DevSecOps, Cloud Security, or a related technical discipline.
Working knowledge of the software development lifecycle and secure software development practices.
Experience identifying, evaluating, or remediating security vulnerabilities in software applications.
Understanding of common application attack vectors, security weaknesses, and software security controls.
Ability to communicate technical security risks and remediation guidance clearly to software engineering and product delivery teams.
Preferred Experience with SAST, DAST, SCA, vulnerability-management platforms, penetration-testing tools, or comparable application security technologies.
Familiarity with OWASP guidance, threat modeling, API security, authentication, authorization, session management, encryption, and secure coding practices.
Experience with GitLab or another source-code repository and CI/CD platform.
Familiarity with Microsoft Azure, Amazon Web Services, or comparable cloud platforms, including identity and access management, logging, networking, and secure deployment concepts.
Experience with Terraform, pipeline automation, infrastructure as code, or scripting using languages such as Python, PowerShell, or Bash.
Familiarity with software supply chain security, including third-party dependency risk, software composition analysis, software bills of materials, artifact integrity, or CI/CD security controls.
Awareness of emerging security considerations associated with AI-enabled applications, machine learning services, or AI-assisted software development.
Candidates who possess qualifications exceeding the minimum job requirements may be considered for higher-level positions based on experience, additional qualifications, demonstrated capabilities, and current busi