Application Security Engineer

Application Security Engineer at Hello Fresh

As an Application Security Engineer at Hello Fresh, you will play a critical role in safeguarding our applications and ensuring the security of our systems. You will collaborate closely with various teams to identify vulnerabilities, implement security measures, and promote best practices across the organization. This position is ideal for someone passionate about application security and eager to contribute to a dynamic and innovative environment.

You will be based in Toronto, Ontario, and have the opportunity to work with a diverse group of professionals dedicated to delivering high-quality services.

• Location:
  
  Toronto, Ontario, Canada
• Engagement:
  Full-time
• Salary:
  Competitive salary based on experience
• Visa:
  Open to candidates requiring work authorization

• Conduct comprehensive security assessments on applications throughout the development lifecycle, identifying vulnerabilities and recommending remediation strategies.
• Collaborate with development teams to integrate security best practices into the software development process, ensuring secure coding standards are followed.
• Develop and maintain security testing frameworks and tools to automate security checks and streamline the assessment process.
• Monitor and analyze security incidents, providing timely responses and implementing lessons learned to prevent future occurrences.
• Create and deliver training sessions for developers and other stakeholders to raise awareness of application security risks and best practices.
• Participate in threat modeling exercises to identify potential security risks in new and existing applications.
• Review and analyze third-party software and services for security compliance, ensuring they meet Hello Fresh's security standards.
• Stay updated on the latest security trends, vulnerabilities, and technologies, sharing insights with the team to enhance our security posture.
• Collaborate with cross-functional teams to ensure security considerations are integrated into project planning and execution.
• Assist in the development and enforcement of security policies, standards, and guidelines related to application security.
• Conduct post-incident reviews to assess the effectiveness of security measures and recommend improvements.
• Contribute to the continuous improvement of the application security program by providing feedback and suggestions based on industry best practices.

• Bachelor's degree in Computer Science, Information Security, or a related field.
• A minimum of 3 years of experience in application security, software development, or a related field.
• Strong understanding of secure coding practices and experience with common web application vulnerabilities (e.g., OWASP Top Ten).
• Proficiency in programming languages such as Java, Python, or JavaScript, with the ability to review and analyze code for security flaws.
• Experience with security testing tools (e.g., SAST, DAST, IAST) and familiarity with CI/CD pipelines.
• Knowledge of security frameworks and standards, such as NIST, ISO 27001, or CIS.
• Excellent problem-solving skills and the ability to work independently as well as collaboratively in a team environment.
• Strong communication skills, with the ability to convey complex security concepts to non-technical stakeholders.
• Familiarity with cloud security principles and experience with cloud platforms (e.g., AWS, Azure, GCP) is a plus.

• Relevant security certifications, such as Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), or Offensive Security Certified Professional (OSCP).
• Experience with Dev Sec Ops  practices and tools.
• Knowledge of container security and orchestration technologies (e.g., Docker, Kubernetes).

• Proficient in security assessment tools and methodologies.
• Familiarity with application security testing tools and frameworks.
• Strong analytical and troubleshooting skills.
• Ability to work with version control systems (e.g., Git).
• Experience with security incident response and management.

• This position is based in Toronto, Ontario, and may require occasional travel for team meetings or conferences.
• The role may involve working flexible hours to accommodate collaboration with teams in different time zones.
• Candidates must be eligible to work in Canada and may require a work visa depending on their situation.