Staff Application Security Developer

Your career is an investment that grows over time!

Wealthsimple is on a mission to help everyone achieve financial freedom by reimagining what it means to manage your money. Using smart technology, we take financial services that are often confusing, opaque and expensive and make them transparent and low-cost for everyone. We’re the largest fintech company in Canada, with over 3 million users who trust us with more than $30 billion in assets.

Our teams ship often and make an impact with groundbreaking ideas. We're looking for talented people who keep it simple and value collaboration and humility as we continue to create inclusive and high-performing teams where people can be inspired to do their best work.

About the Application Security & Posture Management team:

At Wealthsimple, we value our customers' trust above all. Our Application Security Team is dedicated to protecting this trust by ensuring the utmost security of our applications and customer data.

In close collaboration with development teams, we integrate security measures and practices into every stage of our Software Development Lifecycle. We also partner with them to build secure features and capabilities into our products. Our proactive efforts are focused on identifying and mitigating risks within our applications, ensuring solutions are both timely and scalable.

Our mission extends beyond securing systems; we aim to safeguard our customers' trust, reinforcing Wealthsimple's position as the most trusted company in the world. We also cultivate a strong security culture throughout the company, empowering all employees to uphold and advocate for our high security standards.

We’re looking for someone who will:

• Build security tooling, automations and processes to integrate security into the Software Development Lifecycle with developer experience in mind. Examples include SAST, SCA, Secrets Detection, Nuclei, Input Validation modules, and or GraphQL Security controls.
• Conduct security assessments and threat model application designs and solutions.
• Audit source code and perform code reviews for critical application changes.
• Provide hands-on vulnerability remediation guidance to developers.
• Design and implement attack scenarios to simulate real-world threats, allowing us to uncover any potential weaknesses in our systems and infrastructure.
• Engage in detection engineering to identify and analyze potential threats and attacks. Develop threat detection logic and response processes for applicable datasets. Respond to alerts as needed.
• Keep up-to-date with the latest security trends, tools, and techniques to continuously enhance the security posture of the organization. You will research and evaluate emerging threats and vulnerabilities, and provide recommendations for improving our security practices, further enhancing security within Wealthsimple.
• Provide guidance and mentorship. You will share your knowledge and experience to help develop the skills and expertise of fellow team members and essentially, help grow our team.
• Collaborate with development teams to build security features and capabilities into our products that enhance customer trust.

We're looking for someone who:

• Has proficiency developing Ruby on Rails applications.
• Is able to reason through JavaScript, Python & Java/Kotlin code bases which are languages used in some of our support services.
• Understands and can identify and propose fixes for application security gotchas such as those listed in OWASP Top 10.
• Possesses an offensive security mindset. You wonder and ask what could go wrong.
• Is comfortable with digging into logs using tools such as SQL and SIEM.
• Is able to clearly and effectively communicate, internally and externally, security best practices and strategy.
• Is an effective listener, consensus builder and effectively incorporates diverse ideas into a coherent vision.