Security Engineer

What You will do:

• Conduct security reviews of product features, integrations, and platform changes, documenting resulting security requirements
• Participate in threat modeling exercises to identify risks in system design and data flow
• Perform security assessments of applications, APIs, and cloud configuration, and provide remediation guidance engineering teams can act on
• Review AI-enabled product features for prompt injection, excessive agency and unintended exposure of member data
• Triage and score security findings, and drive remediation with the owning teams
• Own the configuration, tuning, and triage workflow for security tooling
• Automate manual review efforts and embed security checks into the SDLC
• Build training materials and documentation on secure coding practices and common vulnerabilities; regularly share knowledge with peers
• Support League’s shift left by contributing reusable security controls to our paved road so that common vulnerabilities are prevented by default
• Contribute to the development and maintenance of League’s security standards and internal documentation.
• Conduct security reviews of third-party vendors that process or store League data, and support customer security assurance requests.
• Support SOC 2 Type II, HITRUST, HIPAA, and PHIPA control design, testing, and evidence gathering in partnership with the Privacy and Compliance team.
• Communicate risk findings clearly to different audiences, adapting language and level of detail for engineers versus leadership.
• What You Bring
• 2+ years of professional experience in application or product security, or in software engineering with substantial security responsibility
• Ability to find what scanners miss: broken access control, tenant isolation failures, business logic flaws
• Working knowledge of authentication and authorization in modern applications, including OAUTH 2.0 / OIDC, session and token handling, and role or attribute-based access control
• Familiarity with CI / CD and software supply chain security, including pipeline-integrated testing, dependency management, and secrets handling
• Solid working knowledge of common application vulnerabilities (e.g., OWASP Top 10) and their mitigations
• Experience with AI and LLM application security, including prompt injection, agentic tool-use risk and retrieval pipeline exposure
• Some exposure to cloud security concepts and secure cloud architecture, ideally GCP, including containerized workloads.
• A track record of writing and shipping code other people rely on, in Python, Go, or a comparable language
• Some experience with threat modeling methodologies (e.g. STRIDE)
• General awareness of SOC 2 Type II, HITRUST, HIPAA and PIPEDA
• Nice-to-have
• Experience handling PHI or comparably sensitive data in a regulated environment.
• Exposure to incident response.
• Self-driven security work: side projects, CTFs, published research, or a coordinated disclosure history
• Security-Related Responsibilities
• Ensure access management is performed in compliance with the employee's role and responsibilities
• Responsibility and accountability for executing League's policies and procedures within the department/ team
• Notification of HR, Legal, Compliance & Security of any incidents, breaches or policy violations
• Compliance with Information Security Policies
• CANADA APPLICANTS ONLY: The Canada-specific compensation range below for this full-time position is exclusive of bonus, equity and benefits. This range reflects the minimum and maximum target for base salaries for the position across all Canadian locations. The salary range is intentional to account for the performance and career progressions a Leaguer will experience in the role throughout their time at League. Where in the band you may land is determined by job-related skills/experience. Your recruiter can share more about the specific salary range specific to your skills and experience during the hiring process.
• Use AI tools as part of your daily workflow to enhance productivity, problem-solving, and decision-making (e.g., drafting, analysis, coding, research, or process automation)
• Apply judgment and accountability when using AI by reviewing outputs for accuracy, bias, and quality before use
• Continuously learn and adapt as new AI tools and capabilities emerge, incorporating them into your ways of working
• Identify opportunities to improve how work gets done from personal productivity to team-level workflows by leveraging AI effectively
• Operate with strong data responsibility and security awareness , especially when working with sensitive or regulated information
• Individual Contributors: Use AI to improve personal productivity and quality of output
• Senior ICs / Managers: Integrate AI into team workflows and improve processes
• Leaders: Drive AI adoption at the organizational level and shape how work is done across teams
• Demonstrated experience using AI tools in a practical, responsible way
• Curiosity and openness to experimenting with new technologies
• Ability to balance efficiency with quality and sound judgment
• You should receive a confirmation email after submitting your application.
• A recruiter (not a computer) reviews all applications at League.
• If we see alignment with League's needs, a recruiter will reach out to learn more about your goals. The recruiter will also share the team-specific interview process depending on the roles you are exploring.
• The final step is an offer, which we hope you will accept!
• Prior to joining us, we conduct reference and background checks. Additional checks could be required for US Candidates, depending on the role you are exploring.
• Learn about our platform, leadership team and partners
• Highmark Health, Google Cloud, League: new digital front door to seamless care
• Former Providence President and Workday EVP of Corporate Strategy join League Board of Directors
• League raises $95 million USD in Series C to build world’s leading healthcare CX platform
• Forbes x League: The Platformization Of Healthcare Is Here
• Fast Company x League: If we want better innovations in healthtech, we need more competition
• Work Location:
• We have a mix of office-centric roles based in our vibrant Toronto office, and remote-eligible roles based anywhere in Canada or US. Each job posting will indicate where the role will be based. Regardless of the role’s posted location, all Toronto-area Leaguers (living within 65 km of our downtown HQ) collaborate in-office Monday through Thursday. Depending on your distance to the office, you’ll enjoy 10 or 20 Flexible Remote Days each quarter for focus and deep-work time. We are committed to fostering a meaningful work environment and connections for all Leaguers regardless of location.
• Recognize and Avoid Employment scams. Practice safe job searching.