Relay is a digital banking platform that gives self-made business owners the tools and know-how to be great with money—bringing clarity, confidence, and control to every dollar earned, so they can turn hard work into lasting success. We do this by replacing financial guesswork with real visibility, transforming cash flow from a constant source of stress into a clear signal owners can use to run stronger, more resilient businesses. We’re looking for an Senior Application Security Engineer II who thrives on autonomy, curiosity, and impact.

You'll join an Application Security team that is deliberately moving away from the advisory model most AppSec functions are stuck in. You’ll work across our stack (from TypeScript and Node.js, to Postgres and AWS cloud infrastructure) ensuring our applications are secure from design to deployment. You’ll blend technical depth with systems thinking, working across teams to identify risks, build guardrails, and evolve our security practices as Relay scales.

Right now, most of Relay’s platform has never been properly tested — and closing that gap is the single highest-leverage thing our team can do this year.

Your mission is to own a defined slice of it end to end: testing the services in scope, working out what's actually exploitable, and fixing what you can yourself. You'll be working next to senior engineers who are maintaining our auth system and building our DAST tooling from scratch.

The Relay

AppSec team genuinely enjoys Application Security and is looking to make an impact on the field.

Threat modeling & offensive testing: Threat model technical design documents (TDDs)



and run white-box penetration tests on our testing environment to identify vulnerabilities from an attacker’s point of view. Triage researcher reports, reproduce/assess impact, coordinate fixes with owners, and close the loop with clear comms and durable controls.

Shipping the fixes you can: Contributing directly to Relay’s code base when it makes sense — writing the patch, not filing the ticket.

Working in our security tooling and extending it: Datadog security, secrets scanning and logging, Burp Suite, and in-house tools you'll be expected to modify rather than just operate.

Building with AI as a default: Two weekly standups, a biweekly security champions session with product engineers, and a weekly Hack The Box session.

Software supply chain: SBOM on every build, dependency pinning/owner verification, private registries/proxies, and runtime SCA detections. You have 5 to 6 years of qualified security experience. Application security, penetration testing, or product security engineering or similar roles. You’ve shipped production code: Production-level software real users depended on.

Security fundamentals: Deep understanding of OWASP Top 10 and real-world exploitation/mitigation techniques. You build with AI. You use AI tooling in your daily work and you've built something with it.





Clear communicator & collaborator: you are a collaborator who loves to partner with developers to bring value to customers in the most secure way possible.

Mentorship: You are comfortable mentoring team members and members of other teams on security best practices. Stage 1: A 60-minute Google Meet video call with the Hiring Manager Stage 2: Stage 3: A 60-minute Secure Code Review and Coaching session with two members of our Customer Experience team Stage 4: A 45-minute Google Meet video call with a member of our leadership team The annual salary range for this role is $180,000 CAD to $220,000 CAD. For candidates who demonstrate full readiness for the defined scope of the role, the typical starting salary is $200,000 CAD.

For more information on our compensation philosophy and perks and benefits, visit our Candidate Hub. If you’re someone who takes initiative, is comfortable taking risks, and seeks input when needed, you’ll find the freedom here empowering. You build with AI, not just use it: You're actively embedding AI into how you work, pushing what's possible, and bringing your team along with you.

You’re comfortable building from scratch, iterating as you go, and collaborating to shape the best path forward. Relay exists to help them thrive -- and that mission has to resonate with you. We welcome diverse backgrounds and people who think critically, challenge the status quo, and want to help small businesses thrive.

If you require accommodations at any stage of the hiring process, please reach out to your Talent Partner.

📌 Senior Application Security Engineer II (Toronto)
🏢 Relay
📍 Toronto