Being part of Air Canada is to become part of an iconic Canadian symbol, recently ranked the best Airline in North America. Let your career take flight by joining our diverse and vibrant team at the leading edge of passenger aviation.
The Partner, Product Security leads product security engagement across a portfolio of digital products and platforms, serving as the single point of entry into Cybersecurity & GRC for security support across IT, Data, & Digital (IDD). Partnering closely with product, engineering, and architecture teams, the incumbent ensures security is embedded throughout the product lifecycle - from ideation through to production deployment. Leveraging the organization's agentic capabilities, this role owns threat modeling, risk management, and secure-by-design practices, balancing delivery velocity against risk reduction. The Partner also provides security posture leadership for assigned portfolios and drives consistent application of secure SDLC controls and governance.
This position may be located in Montreal or Toronto.
Responsibilities:
Own the product security posture for an assigned portfolio of products and platforms
Lead security engagement across the full product lifecycle, from ideation through production
Drive and oversee threat modeling for new and existing products, using agentic tooling to scale coverage and reduce manual effort
Partner with product managers and engineering leads to embed secure-by-design practices into delivery workflows
Provide risk-based security guidance during architecture and design reviews
Ensure secure Product Development Lifecycle controls are implemented and consistently applied across development teams
Track and manage security risks, vulnerabilities, and remediation priorities to closure
Establish and govern secure usage patterns for agentic development tools and AI gateways, including guardrails for AI-assisted coding, prompt and model access controls, and data handling




Assess the security implications of AI-enabled and agentic capabilities introduced into products, including third-party models, agents, and integrations
Support security assessments for new technologies, integrations, and third-party solutions
Collaborate with Enterprise and Solution Architecture teams to apply reference security patterns
Provide oversight and direction to Product Security Advisors (where applicable)
Facilitate security decision-making and risk acceptance discussions with product and business stakeholders
Monitor security posture metrics and maturity improvements across the portfolio
Coordinate security testing activities, including penetration testing and automated scanning
Promote developer enablement through security education, guidance, and reusable patterns
Participate in architecture review boards and product governance forums
Identify and deliver opportunities to automate and standardize security controls, applying agentic and AI-assisted approaches where they improve speed, consistency, or coverage
Support continuous improvement of the product security operating model
Work closely with Enterprise Architecture, Cloud, and DevOps teams, as well as across Cybersecurity & GRC
Qualifications
Bachelor’s degree in Information Technology, Computer Science, Engineering, or related field
Minimum 8-10 years of IT experience with at least 3-5 years in security, architecture, or application development
Experience with secure SDLC practices and threat modeling
Knowledge of application, API, cloud, and data security principles
Experience working with Agile / product-based delivery models




Strong stakeholder management and communication skills
Ability to influence technical teams without direct authority
Experience working in large-scale enterprise environments
Security certifications (CISSP, CSSLP, CCSP, or equivalent)
Experience with DevSecOps tooling and CI/CD pipelines
Familiarity with OWASP, NIST SSDF, or similar frameworks
Experience in cloud-native architectures (AWS, Azure)
Demonstrate punctuality and dependability to support overall team success in a fast-paced setting.
Assets:
Hands-on experience with agentic development tools such as Anthropic's Claude Code, OpenAI Codex, GitHub Copilot, or comparable platforms
Experience designing, securing, or operating AI gateways and associated access, logging, and data-protection controls
Familiarity with emerging AI/LLM threat models and secure patterns for agent-based systems
Conditions of Employment:
Candidates must be eligible to work in the country of interest at the time any offer of employment is made and are responsible for obtaining any required work permits, visas, or other authorizations necessary for employment. Prior to their start date, candidates will also need to provide proof of their eligibility to work in the country of interest.
Linguistic Requirements
Based on equal qualifications, preference will be given to bilingual candidates.
Diversity and Inclusion
Air Canada is strongly committed to Diversity and Inclusion and aims to create a healthy, accessible and rewarding work environment which highlights employees’ unique contributions to our company’s success.
As an equal opportunity employer, we welcome applications from all to help us build a diverse workforce which reflects the diversity of our customers, and communities, in which we live and serve.
Air Canada thanks all candidates for their interest; however only those selected to continue in the process will be contacted.

📌 Partner, Product Security (Quebec City)
🏢 Air Canada
📍 Quebec City