Location: Remote - Canada

Employment Type: Full-Time

Team: Information Security

Upgrade is a fintech unicorn founded in 2017. We are the fastest-growing company in the Americas (Financial Times). Our innovative Upgrade Card is the fastest-growing credit card in America (Nilson Report). Upgrade has been named a “Best Place to Work in the Bay Area” and received “Best Engineering Team", "Best Company for Women” and “Best Company for Diversity” awards from Comparably. Come join us if you like to tackle big problems and make a meaningful difference in people's lives.

About our Team:

As a core Application Security Engineer at Upgrade, you’ll have direct access and work directly with our Head of Infosec to scale our static and dynamic code analysis, handle manual and automated pen-testing, threat modeling, and lead the overall improvement of our appsec posture. You’ll collaborate alongside DevOps, QA, and Engineering to improve the security of applications architected 100% on the cloud (AWS) in a fully microservices-based environment.

This is a remote position based in Canada. At this time we are unable to consider international applicants for this role.

What You'll Do:

• Evaluate our security technology. methodology, and tools to better the software development life cycle.
• Help train developers, and QA personnel to the appropriate level of software security knowledge to perform their responsibilities.
• Improve and support application security tool services including static analysis and dynamic testing tools.
• Support incident response and architecture review processes whenever application security expertise is needed.
• Manage routine penetration testing services, including both expert consulting and managed services.
• Provide manual penetration testing and standards gap analysis services to internal business and technology partners.
• Support, improve and maintain secure development standards and application security framework projects.
• Support Vendor Management activities to ensure third party software and development meet security standards.
• Integrate threat modeling practices into the product development life cycle.
• Provide security requirements for test driven design to assess control effectiveness.
• Produce metrics reporting the state of application security programs and performance of development teams against requirements.

What We Look For:

• 5+ years of relevant work experience.
• Experience with agile development processes and have experience integrating secure development practices into the model.
• Experience writing and testing web applications, mobile applications and microservices.
• Familiarity with graphQL architecture and security best practices.
• Basic understanding of authentication and authorization schemes including OAuth.
• Familiarity with a variety of development and testing tools.
• Experience working with one or more SAST, DAST, SCA and IAST tools.
• Ability to explain vulnerabilities and weaknesses, and discuss effective defensive techniques.
• Experience with cyber security attacks and mitigation methods (red/blue team experience).
• Experience working with web applications and browser security; security assessments and penetration testing; identity and access control; applied cryptography and security protocols; security information and event monitoring and intrusion detection.
• Expertise in employing analytics and threat intelligence techniques, incident response process, software security.
• Basic familiarity with python for security tool automation would be a plus.
• Experience in IT supply-chain risk management and assurance, as well as cloud security operations.

What We Offer You:

• Competitive salary and stock option plan.
• 100% paid coverage of medical, dental and vision insurance.
• Unlimited vacation.
• Learning stipend for personal growth and development.
• Paid parental leave.
• Health and wellness initiatives.

Interested in joining Upgrade but don't think this role is for you? Check out our careers page!

Interested in joining Upgrade but don't think this role is for you? Check out our careers page!

We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.