Application Security Engineer Ii

Spring Financial is a Canadian financial technology company focused on making every day financial services simpler, faster, and more accessible. We build technology that helps Canadians build credit, save money, and access lending products without unnecessary friction. Our platforms allow customers to apply and manage their finances online, by text, or over the phone, making the experience convenient and flexible. Since launching in 2014, Spring has grown into one of Canada’s largest fintechs, with over 250,000+ product originations across credit‑building products, personal lending, and mortgage solutions. We give people ownership, trust them to make decisions, and focus on building systems that scale reliably. If you’re interested in working on real‑world fintech platforms used by hundreds of thousands of Canadians, Spring offers the opportunity to make a tangible impact through well‑built technology. NOTE: This is a full‑time, permanent, hybrid position in downtown Vancouver. 3 set days in the office and 2 WFH. As an Application Security Engineer II, you are an experienced practitioner who works independently to secure Spring’s applications, services, and APIs. You take ownership of application security across one or more product domains and play a central role in keeping those systems safe as they evolve. You understand the “why” behind the work, connecting security decisions to customer trust, regulatory commitments, and business outcomes. You demonstrate good judgment when working through ambiguity and elevate the security posture of the systems and teams around you. Lead threat modeling, secure code reviews, and security architecture reviews for features and services in your domains, including APIs and authentication flows. Partner with engineering teams to remediate vulnerabilities across applications, APIs, and cloud configurations, driving issues to closure. Own and evolve sections of Spring’s SDL, embedding security checks and guardrails into CI/CD pipelines, and moving them from advisory to enforced with clear exception handling. Operate, tune, and improve automated security testing across code, dependencies, containers, and infrastructure, so findings are accurate and actionable. (Snyk, GitHub Advanced Security, Burp Suite, Semgrep, Checkov). Help define how vulnerabilities are tracked, prioritized, and closed, including exceptions and risk acceptance. Use AI tools to accelerate vulnerability research, code review, and remediation guidance, validating output critically, and help build AI‑assisted security automation with human review gates. Triage cloud security and monitoring findings, and contribute to logging and detection improvements. Collaborate with platform and DevOps teams on identity, access, and secrets management patterns (e.g., OAuth/OIDC, SSO, JWT token handling, Vault, AWS IAM). Mentor early‑career application security engineers and help raise the team’s technical bar. 3+ years of experience in application security, security engineering, or software engineering with a security focus. ~ Solid working knowledge of web and cloud application security principles, the OWASP Top 10, and secure coding best practices. ~ Proficiency reviewing code in at least one modern language, and scripting to automate security tasks. ~ Hands‑on experience running automated security testing in a development pipeline, including tuning rules and reducing false positives. (Snyk, GitHub Advanced Security, Burp Suite, Semgrep, Checkov, or similar). ~ Working knowledge of AWS and cloud‑native architecture (e.g., Solid understanding of identity, access, and secrets management patterns (e.g., OAuth/OIDC, SSO, JWT token handling, Vault, AWS IAM). ~ Effective use of AI development and security tools in day‑to‑day work, and an understanding of AI‑specific security risks (e.g., prompt injection, data leakage). ~ A relevant security certification (e.g. eJPT, OSCP, OSWE, BSCP, or AWS Security Specialty) AI security training or certification (e.g., AWS Certified AI Practitioner, Hack The Box AI Red Teamer path or OSAI) PortSwigger Web Security Academy, Hack The Box) Bug bounty findings or CTF participation or open‑source security contributions. Competitive annual salary ranging from $85,000 to $115,000, reflective of experience and impact. Comprehensive benefits package, including extended health, dental, and vision coverage
- with 100% of monthly premiums covered by the Spring. GRSP matching program to support your long‑term financial goals.