Application Security, Lead

*
* Who We Are:

** Every transaction matters. Every Canadian matters. At Interac, we protect both — driving trust, security, and inclusion, so our digital economy thrives.
Founded in 1984, Interac connects Canadians through secure digital payments, advanced identity verification and industry-leading fraud protection. Connecting banks, businesses, and individuals, Interac enables millions to send, receive, and manage money safely and effortlessly every day — across both digital and physical environments.

As the backbone of Canada’s financial ecosystem, Interac facilitates over 20 million transactions daily, supported by trusted partnerships with government and financial institutions. Consistently ranked as Canada’s most reputable financial technology brand, Interac is deeply embedded in the daily lives of Canadians.
** Who You Will Work With:
** We are currently recruiting for a vacant Application Security Lead to be part of our Threat & Vulnerability Management team within Cybersecurity. Reporting to our Leader, Threat & Vulnerability Management, this role will lead the Application Security practice and work with cross functional teams to ensure products and applications are built securely.
*
* What You Will Do:

*** Lead application security practice at Interac in alignment with product and business objectives.
* Build and maintain a comprehensive application security strategy to identify and mitigate product vulnerabilities.
* Work alongside and educate product development teams as the subject matter expert in application security to design secure products to protect Interac’s customers.
* Integrate application security tools into Dev Sec Ops  practice, reducing development friction and vulnerabilities in production
* Integrate application security processes throughout the Secure Software Development Life Cycle (SSDLC).
* Perform threat modelling on new systems, products, and features and facilitate secure architecture and design discussions.
* Develop and implement code reviews and automated security testing processes to monitor compliance to secure coding standards.
* Develop and report on actionable KPIs and KRIs against application security policies and standards
* Collaborate with other cybersecurity functions such as IR, VM, and Cloud Security as needed to mitigate application security risk.
* Continuously improve application security technology by staying up-to-date with latest trends and advancements
* Clearly communicate with both technical and non-technical stakeholders, ensuring transparency and understanding of security measures.
* Demonstrate proficiency in programming languages commonly used in application development.
*
* What You Bring:

*** 5-7 years of experience in Application Security or related fields
* Post-Secondary degree or diploma in Engineering, Programming/Systems, Computer Science, or other related discipline.
* Eligibility to work for Interac Corp. in Canada in a Full Time Capacity.
* Outcomes driven, the ability to figure-it-out to reach the desired outcome
* Strong sense of personal responsibility and accountability for delivering high quality work, both personally and at a team level.
* Ability to communicate effectively to both technical and non-technical stakeholders
* Ability to work autonomously with attention to detail.
* An understanding of technical concepts and are an avid learner of new technology.
** Technical

Skills:

*** Expertise in Dev Sec Ops  practices and SSDLC frameworks
* Experience with threat modelling, design reviews, and risk analysis
* Strong understanding of security risks, threats, and vulnerabilities
* In-depth knowledge of authentication, authorization, network security, vulnerability exploitation, and vulnerability remediation.
* Experience with SAST/DAST/SCA tools such as Veracode, Sonar Qube, Snyk, or Burp Suite
* Experience with overseeing or conducting application penetration tests
* Proficiency in common programming languages used within application development such as Java, JavaScript, or Python
* Knowledge of security industry standards and best practices such as OWASP, ISO 27001/2, NIST
* Cybersecurity certificates such as CISSP, CSSLP, OSCP
** What We’re…