Staff Application Security Specialist at Workleap | Torre
Staff Application Security Specialist
trending_up Invest in Torre
Workleap

Staff Application Security Specialist

Workleap
Posted by
Alex Dougherty
Emma
Emma
Emma highlights
This highlight was written by Emma’s AI. Ask Emma to edit it.
Full-time

Legal agreement: Employment

Hidden
(SIGN IN to learn if it’s a match)
The job admin(s) requested that this be hidden from the public.

+ Bonuses (up to 15% of base compensation)

+ Equity (up to 5% of the company)

+ Health insurance

location_on
Remote (for Canada residents)
Posted 2 months ago

Responsibilities

Build the security guardrails for AI assisted and agentic development so speed and safety stop being a tradeoff Move security review from human bottleneck to automated first pass with human judgment reserved for what is genuinely ambiguous Achieve near-zero developer friction on security signals by wiring SAST/DAST/SCA into CI/CD with noise tuned low enough that findings actually get fixed. Lead threat modeling on new features and architectural changes Drive real remediation of application security vulnerabilities, measured by risk retired and not tickets closed Harden Azure environments and deployment patterns alongside Infrastructure SecOps Five or more years in application security, DevSecOps, or security focused software development, with a real engineering background behind it Deep working knowledge of web application security, OWASP Top 10, and CWE Top 25 Proven experience building security automation into CI/CD pipelines, GitHub Actions preferred Built and shipped real agent tooling, not just used it. MCP servers, Claude skills, subagents, and custom tools that other people depend on Context engineering as a discipline. Knowing what an agent needs in front of it to reason correctly about a codebase, and what to leave out Understanding of the security model of agentic systems themselves. Prompt injection, tool permission scoping, credential handling in agent workflows, and what an agent with repo write access can do when it is wrong Proficiency in Python for building tooling, not just scripting around it Hands on experience with AI assisted and agentic development workflows and a clear view of where they break Solid grasp of Azure services, infrastructure security, and deployment patterns The ability to explain a risk tradeoff to an engineer and to an executive in the same week and be understood by both Strong assets Secure code review experience in C#/.NET Experience integrating SAST, DAST, SCA, and secret scanning at scale Familiarity with OIDC, SAML, and OAuth Exposure to SOC2 requirements Experience running vulnerability discovery and triage with a developer community
This job post is closed.