Staff Security Developer, Application Security and Posture Management

Your career is an investment that grows over time!

Wealthsimple is on a mission to help everyone achieve financial freedom by reimagining what it means to manage your money. Using smart technology, we take financial services that are often confusing, opaque and expensive and make them transparent and low-cost for everyone. We’re the largest fintech company in Canada, with over 4 million users who trust us with more than $50 billion in assets.

Our teams ship often and make an impact with groundbreaking ideas. We're looking for talented people who keep it simple and value collaboration and humility as we continue to create inclusive and high-performing teams where people can be inspired to do their best work.

About the Application Security & Posture Management Team

• The team is currently growing and owns the security architecture, security tooling, and offensive security testing for our applications. We enable the business and help Wealthsimple win the trust of our clients driving net deposits, client acquisition, and more
• Reporting to the Sr. Engineering Manager, ASPM and part of the broader Security Engineering leadership function with peers in IAM and Infrastructure Security

What you bring:

• With an average of 8 years of experience in security or software development with at least 4 years in application security, and 2 years as a Senior
• Proven experience with the following domains: security tooling (e.g. SAST, DAST, SCA, etc), security architecture (e.g. threat modelling, secure code review, etc), and offensive security (e.g. bug bounty programs, pentesting, etc)
• Ability to read and write code at a Sr. Developer level with a preference for experience with Ruby, Javascript, Java, and Python
• Excellent leadership skills with a track record of being able to work closely with product and development teams while growing talent on the team
• A history that demonstrates a maker owner and growth mindset. You are always thinking and acting like a team player and coach

In the first 3 months our ideal candidate will have:

• Completed their initial assessment of the application security program and team and be able to articulate to the business key risks and opportunities
• Taken over ownership of existing services, libraries, integrations, and processes and began to prioritize any improvements or fixes with the team
• Identified the top 3 areas of risk in our applications and developed proposals to address them while balancing friction to organization and long term support

In the first 6 months our ideal candidate will have:

• Established good working relationships with vulnerability management and our product teams through program and product reviews respectively and will have executed on 2-4 threat modelling or pentesting opportunities
• Begun a coaching and mentoring relationship with more junior developers both inside and outside of the security department helping define and promote a culture of security
• Shipped their first service, library, or process designed to address one of the previously identified top 3 risks in our applications

In the first 12 months our ideal candidate will have:

• Defined their approach to making the easy way the secure way for developers and established a technical vision for the team
• Ensured that the team is firmly integrated in both SDLC and with our partners in product through continuous validation and security scorecarding