jazzhr
Staff Developer / Development Manager, Application Security
atVenu
Calgary, CAN
Full-time
Senior · 8+ years experience
Hybrid
Discovered 3 weeks ago
React NativeReactJavaScriptRuby on RailsGraphQLPostgreSQL
Free
Job Fit Check
Base Career helps you apply smarter for this job.
?%
Ready to ScanKey skills for this role
React NativeReactJavaScript
Key Skills for This Role
React NativeReactJavaScriptRuby on RailsGraphQLPostgreSQL
Full Job Posting
• Front End: React Native, React, JavaScript
- Backend: Ruby on Rails, GraphQL, PostgreSQL, Redis, CouchDB
• Tools: GitHub, Sidekiq, Docker
- Security program leadership: Define the roadmap, own the risk register, and make the case to engineering and executive leadership for what gets resourced and when. You know when to accept calculated risk and when to hold the line — your decisions are pragmatic and reflect thought towards the needs of our business, our customers and compliance.
- Team management: Hire, develop, and retain application security developers. Set technical direction, run code and architecture reviews, unblock your team, and build a security culture that scales across a fast-moving engineering organization without becoming a bottleneck.
- PCI, GDPR, and SOC2 ownership: Maintain and reduce cardholder data environment scope across our Rails API, GraphQL layer, PostgreSQL, and mobile POS app. Own the SOC2 security controls roadmap and drive it to completion.
- Offline payment security: Our React Native POS runs without connectivity during events and syncs payment data on reconnect. You'll direct the audit and hardening of encryption, key management, and CouchDB sync pipeline — a non-trivial challenge when card data lives on-device before it reaches our Rails API.
- Release security reviews: Ensure GraphQL API changes are reviewed for injection risks, IDOR vulnerabilities, and over-exposed tenant data before they reach 500+ venues. Own the SAST/DAST integration in our GitHub CI pipeline and set the bar for what ships.
- Vulnerability and CVE triage: Lead risk-ranked remediation across our Rails/Redis/PostgreSQL/CouchDB stack. Live events don't pause for maintenance windows — your team needs a clear, fast process for deciding what gets patched and when.
- Threat modelling and architecture review: Embed threat modelling into product development for new features — mobile ordering flows, vendor integrations, new hardware platforms. Your team challenges assumptions before code ships.
- Incident response: Be one of the application-layer authorities when something goes wrong at an event. Lead forensics, remediation, and post-mortems in collaboration with Engineering and Compliance.
Apply for this job in 1 click
Skip the repetitive application forms
Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.
Trusted by over 500,000 job seekers on Base Career