Staff Application Security Specialist

You will join LeapSec and report to the Director of Infrastructure and Security. We're a small team with broad reach covering product security, cloud security, and governance across Workleap and ShareGate. That means your work ships, you own it end to end, and you set the priorities that matter. The scope is real, and so is the autonomy that comes with it.

You will partner closely with the AI SDLC team, which builds the internal platform that lets AI agents operate across the development lifecycle, and with product engineering across the organization.

Five or more years in application security, DevSecOps, or security focused software development, with a real engineering background behind it

Deep working knowledge of web application security, OWASP Top 10, and CWE Top 25

Proven experience building security automation into CI/CD pipelines, GitHub Actions preferred

Built and shipped real agent tooling, not just used it. MCP servers, Claude skills, subagents, and custom tools that other people depend on

Context engineering as a discipline. Knowing what an agent needs in front of it to reason correctly about a codebase, and what to leave out

Understanding of the security model of agentic systems themselves. Prompt injection, tool permission scoping, credential handling in agent workflows, and what an agent with repo write access can do when it is wrong

Proficiency in Python for building tooling, not just scripting around it

Hands on experience with AI assisted and agentic development workflows and a clear view of where they break

Solid grasp of Azure services, infrastructure security, and deployment patterns

The ability to explain a risk tradeoff to an engineer and to an executive in the same week and be understood by both

Strong assets

Secure code review experience in C#/.NET

Experience integrating SAST, DAST, SCA, and secret scanning at scale

Familiarity with OIDC, SAML, and OAuth

Exposure to SOC2 requirements

Experience running vulnerability discovery and triage with a developer community

Annual bonus program.

LTIP program, share in Workleap's long-term growth.

RRSP + Family health insurance + telemedicine + annual wellness budget.

Flexible vacation policy.

Remote work, with access to our Montreal office.

In-person gathering twice a year.

Claude access, for everyone.

At Workleap, we build software that sits at the center of how people experience work, every day, at every level.

We move fast. Priorities shift, decisions get made with the information we have, and we iterate. If you thrive on intensity and ambiguity doesn't slow you down, you'll feel right at home. We're builders. We do what it takes to move forward. AI is part of our toolkit. We use it to go faster and decide smarter, not to replace judgment.

If you want real impact and a place where your decisions matter, this is it.

Transparency is how we hire — for you as much as for us.

Here's how it works: a first call with a recruiter, then a virtual interview with the hiring manager. You'll then complete a take-home case study, followed by a meet with future colleagues to discuss it together. Depending on the role, the process may vary slightly — your recruiter will walk you through it on your first call.

We use AI to support certain steps of the process, but every hiring decision remains human.

We can't wait to meet you.

By applying, you confirm that you have read and agree to our privacy policy.

#LI-Remote