Fortify Security jobs in Ontario

Application Security SME – DevSecOps, OWASP, API Security, Checkmarx, Fortify

44 king scotia plaza, Toronto ON – 3Days onsite

12 Months Contract

Key Responsibilities

Application Security Strategy & Advisory

• Act as the Subject Matter Expert (SME) for application security across enterprise platforms and development teams
• Define and enhance the organization’s application security strategy, standards, and control frameworks
• Provide expert guidance on secure design, secure coding, threat mitigation, and vulnerability management
• Partner with engineering and architecture teams to embed security-by-design principles into applications and digital initiatives

Secure SDLC / DevSecOps Enablement

• Drive implementation and maturity of the Secure Software Development Lifecycle (SSDLC)
• Integrate security controls and testing into CI/CD pipelines and DevSecOps workflows
• Enable use of security tools and automation across build and release processes
• Promote a shift-left security approach to detect and remediate issues early in the development lifecycle

Architecture Reviews & Threat Modeling

• Perform application architecture and design reviews to identify security risks and recommend remediation strategies
• Lead threat modeling sessions for web, mobile, API, and cloud-native applications
• Review application components for vulnerabilities related to authentication, authorization, session management, input validation, data protection, and API security
• Recommend secure reference architectures, reusable security patterns, and implementation guardrails

Security Testing & Vulnerability Management

Lead or support application security assessments, including:

• Static Application Security Testing (SAST)
• Dynamic Application Security Testing (DAST)
• Software Composition Analysis (SCA)
• API Security Testing
• Manual security reviews and penetration testing coordination
• Analyze, triage, and prioritize vulnerabilities based on risk and business impact
• Work closely with development teams to track remediation and validate closure of security issues
• Support secure management of open-source components and third-party libraries
• Cloud & Modern Application Security

Provide security guidance for modern application environments, including:

• Microservices and APIs
• Containers and Kubernetes
• Cloud-native applications
• Serverless and event-driven architectures
• Collaborate with cloud and platform engineering teams to secure application workloads in Azure, AWS, or GCP

Compliance, Governance & Risk

• Ensure application security practices align with internal security policies and external standards/regulations
• Support compliance requirements related to secure development and application security controls
• Contribute to audit responses, control evidence collection, and security risk assessments
• Develop security metrics, dashboards, and reporting to track application security posture and control effectiveness

Required Qualifications

• Bachelor’s degree in Computer Science, Information Security, Engineering, or related field
• 8+ years of experience in application security, secure software engineering, cybersecurity architecture, or related roles
• Proven experience implementing and managing application security programs in enterprise environments

Strong understanding of:

• Secure SDLC / SSDLC
• DevSecOps principles
• OWASP Top 10
• API Security Top 10
• Common software and web application vulnerabilities
• Hands-on experience with application security testing tools such as:
• SAST: Checkmarx, Fortify, Veracode, SonarQube
• DAST: Burp Suite, AppScan, Acunetix
• SCA: Snyk, Black Duck, Mend/WhiteSource
• Experience in threat modeling methodologies (e.g., STRIDE)
• Strong knowledge of authentication, authorization, encryption, secrets management, and secure design principles
• Experience working with cloud platforms such as Azure, AWS, or GCP
• Strong verbal and written communication skills with ability to work across technical and non-technical stakeholders

Preferred Qualifications

• Experience in highly regulated industries such as Banking, Financial Services, Insurance (BFSI), healthcare, or public sector
• Familiarity with security requirements related to standards/frameworks such as:
• NIST
• ISO 27001
• PCI-DSS
• SOC 2
• OSFI guidance (for Canada-based roles)
• Experience with CI/CD platforms such as Azure DevOps, Jenkins, GitHub Actions, or GitLab
• Exposure to container security, Kubernetes security, and cloud workload protection
• Familiarity with red team / blue team collaboration for application-layer attack simulation and response readiness

Preferred Certifications

• CISSP
• CSSLP
• CISM
• CEH / GWAPT / OSCP (nice to have)
• Cloud Security certifications (Azure / AWS / GCP)

Key Skills & Competencies

• Deep expertise in application security architecture and secure development practices
• Strong analytical and problem-solving capabilities
• Ability to influence and partner with engineering teams in a collaborative manner
• Excellent stakeholder management and communication skills
• Strong understanding of balancing security, agility, and business priorities
• Ability to work independently and lead strategic application security initiatives

Pay: $75.00-$80.00 per hour

Work Location: Hybrid remote in Toronto, ON (Toronto District)