{"id":3218564,"url":"https://alion.io/job/the-french-sourcer-lead-application-security-engineer-remote","title":"Lead Application Security Engineer — Remote","company":{"id":4451662,"name":"The French Sourcer","domain":"thefrenchsourcer.com","url":"https://alion.io/company/thefrenchsourcer","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Manatal","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Toronto, Canada"],"countries":["CA"],"hiring_countries":["CA"],"hiring_countries_total":1,"salary":{"min":220000,"max":320000,"currency":"USD","period":"year","gross":null,"usd_annual":320000},"salary_estimate":null,"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"GCP","optional":false},{"name":"GDPR","optional":false},{"name":"Go","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false}],"status":"live","first_seen_at":"2026-10-25T01:07:25Z","employer_posted_date":"2026-10-25","last_verified_at":"2026-10-29T23:17:08Z","board_verified":true,"closed_at":null,"days_open":5,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":5},"description":"Lead Application Security Engineer - Remote (Canada)\nRemote, Canada · Permanent · Remote\nCompensation: $220,000 to $320,000 USD base, plus competitive equity\nBe the first security engineer on a platform that moves customer data for hundreds of enterprises, where tenant isolation is a problem you solve in the code and the roadmap is yours to write.\nWhat you'd actually work on\nOwning application security end to end as the first dedicated security hire, reporting to the VP of Engineering, while the engineering team roughly doubles in size\nSpending most of your week in the codebase, reading and writing production TypeScript and Go, and shipping security fixes yourself\nThreat modeling new products and major redesigns early, while design choices are still cheap to change, and hardening them before they reach customers\nDesigning sub-tenant access control for multi-team and multi-brand customers who need different levels of access to configuration and data inside the same account\nImproving rate limiting, abuse detection and the granularity of access control on internet-facing APIs that serve customer data at high volume\nExtending a multi-region, multi-cloud backend into new regions so global customers can meet their data residency requirements, with security designed into each launch\nBuilding your own roadmap: looking at the architecture, finding the highest-leverage problems and going after them, with the autonomy that comes with being the first person in the role\nWhere it gets technically interesting\nMulti-tenant isolation on a system that runs very large volumes of data jobs every day and ingests a high-throughput stream of events. At that scale, a single isolation gap can expose one customer's data to another, so the margin for error is very small\nCompute isolation frameworks that you'll build and refine, balancing how strongly customer workloads are separated against cost and performance on a platform that keeps growing fast\nA backend spread across AWS, Azure and GCP that often operates against customer-owned cloud accounts, which means part of the trust boundary runs through infrastructure you don't control\nAn authorization model for sub-tenants that has to be right early, because once hundreds of enterprise customers organize their teams and brands on top of it, changing it gets very expensive\nHigh-throughput public APIs where rate limiting and abuse detection must stop bad traffic without adding latency or blocking legitimate customers\nPrivacy controls (PII handling, data residency, GDPR and CCPA) that are core engineering work here, since the product sits directly on top of customers' personal data\nWhat we're looking for\nA real background as a backend software engineer: you wrote production code (APIs, distributed systems, data pipelines) inside a product codebase before or alongside your move into security. The team cares much more about what you've built than about certifications\n6+ years in security engineering with deep distributed systems knowledge, enough to understand what product teams are building and influence it from a place of trust\nExperience as an early security hire (first 1 to 3) at a SaaS or data infrastructure company, plus 2+ years at a venture-backed or high-growth company as it went through real scale\nStaff or Lead level today, reached through promotions over tenures of 2 years or more\nHands-on experience securing multi-tenant platforms (tenant isolation, authorization models) and systems that span several clouds or regions\nA degree in Computer Science, Math, Physics or a similar field, and the ability to explain a design clearly and stay precise under deep technical questions\nBonus: privacy-adjacent security work, having designed or secured data infrastructure as an early engineer, or experience at a security-focused company. Former managers who want to return to a fully hands-on IC role are welcome\nThe company\nA late-stage B2B data and AI company, backed by top-tier investors, whose platform helps businesses turn their customer data into personalized marketing, with a growing part of that work now driven by AI agents. Revenue and headcount have been growing fast year over year, and hundreds of companies rely on the platform in production. Several hundred people, fully remote, with an engineering culture that holds a very high bar for quality and simple, scalable software. This is the company's first dedicated security role: it reports to the VP of Engineering and works across every product team. Competitive equity and benefits. Remote within Canada.\nLanguages: English (fluent, professional)\nA search run by The French Sourcer, recruitment built for technical teams.","description_format":"text","description_chars":4674,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":["Equity"],"hiring_locations":[{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Recruiting Software & ATS"],"lifecycle":[{"event":"open","at":"2026-10-25T01:07:25Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":4,"expected_fill_days":39,"reasons":["conf:0","velocity","win:early"],"computed_at":"2026-10-29T05:49:05Z"},"pay":{"stated_usd_annual":320000,"is_top_pay":true},"html_url":"https://alion.io/job/the-french-sourcer-lead-application-security-engineer-remote","json_url":"https://alion.io/job/the-french-sourcer-lead-application-security-engineer-remote.json","meta":{"generated_at":"2026-10-30T02:57:50Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":3890,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-31T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4451662},"rest":"https://alion.io/mcp/rest/get_company?id=4451662"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fthe-french-sourcer-lead-application-security-engineer-remote"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fthe-french-sourcer-lead-application-security-engineer-remote"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fthe-french-sourcer-lead-application-security-engineer-remote"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/the-french-sourcer-lead-application-security-engineer-remote\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fthe-french-sourcer-lead-application-security-engineer-remote"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3218564}},{"tool":"search_jobs","arguments":{"company":"thefrenchsourcer.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3218564},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}