Being part of Air Canada is to become part of an iconic Canadian symbol, recently ranked the best Airline in North America. Let your career take flight by joining our diverse and vibrant team at the leading edge of passenger aviation.

The Partner, Product Security leads product security engagement across a portfolio of digital products and platforms, serving as the single point of entry into Cybersecurity & GRC for security support across IT, Data, & Digital (IDD). Partnering closely with product, engineering, and architecture teams, the incumbent ensures security is embedded throughout the product lifecycle - from ideation through to production deployment. Leveraging the organization's agentic capabilities, this role owns threat modeling, risk management, and secure-by-design practices, balancing delivery velocity against risk reduction.

The Partner also provides security posture leadership for assigned portfolios and drives consistent application of secure SDLC controls and governance.

This position may be located in Montreal or Toronto.

Responsibilities:

Own the product security posture for an assigned portfolio of products and platforms

Lead security engagement across the full product lifecycle, from ideation through production

Drive and oversee threat modeling for new and existing products, using agentic tooling to scale coverage and reduce manual effort

Partner with product managers and engineering leads to embed secure-by-design practices into delivery workflows

Provide risk-based security guidance during architecture and design reviews

Ensure secure Product Development Lifecycle controls are implemented and consistently applied across development teams

Track and manage security risks, vulnerabilities, and remediation priorities to closure

Establish and govern secure usage patterns for agentic development tools and AI gateways, including guardrails for AI-assisted coding, prompt and model access controls, and data handling





Assess the security implications of AI-enabled and agentic capabilities introduced into products, including third-party models, agents, and integrations

Support security assessments for new technologies, integrations, and third-party solutions

Collaborate with Enterprise and Solution Architecture teams to apply reference security patterns

Provide oversight and direction to Product Security Advisors (where applicable)

Facilitate security decision-making and risk acceptance discussions with product and business stakeholders

Monitor security posture metrics and maturity improvements across the portfolio

Coordinate security testing activities, including penetration testing and automated scanning

Promote developer enablement through security education, guidance, and reusable patterns

Participate in architecture review boards and product governance forums

Identify and deliver opportunities to automate and standardize security controls, applying agentic and AI-assisted approaches where they improve speed, consistency, or coverage

Support continuous improvement of the product security operating model

Work closely with Enterprise Architecture, Cloud, and DevOps teams, as well as across Cybersecurity & GRC

Qualifications

Bachelor’s degree in Information Technology, Computer Science, Engineering, or related field

Minimum 8-10 years of IT experience with at least 3-5 years in security, architecture, or application development

Experience with secure SDLC practices and threat modeling

Knowledge of application, API, cloud, and data security principles

Experience working with Agile / product-based delivery models





Solid stakeholder management and communication skills

Ability to influence technical teams without direct authority

Experience working in large-scale enterprise environments

Security certifications (CISSP, CSSLP, CCSP, or equivalent)

Experience with DevSecOps tooling and CI/CD pipelines

Familiarity with OWASP, NIST SSDF, or similar frameworks

Experience in cloud-native architectures (AWS, Azure)

Demonstrate punctuality and dependability to support overall team success in a fast-paced environment.

Assets:

Hands-on experience with agentic development tools such as Anthropic's Claude Code, OpenAI Codex, GitHub Copilot, or comparable platforms

Experience designing, securing, or operating AI gateways and associated access, logging, and data-protection controls

Familiarity with emerging AI/LLM threat models and secure patterns for agent-based systems

Conditions of Employment:

Candidates must be eligible to work in the country of interest at the time any offer of employment is made and are responsible for obtaining any required work permits, visas, or other authorizations necessary for employment. Prior to their start date, candidates will also need to provide proof of their eligibility to work in the country of interest.

Linguistic Requirements

Based on equal qualifications, preference will be given to bilingual candidates.

Diversity and Inclusion

Air Canada is strongly committed to Diversity and Inclusion and aims to create a healthy, accessible and rewarding work environment which highlights employees’ unique contributions to our company’s success.

As an equal opportunity employer, we welcome applications from all to help us build a diverse workforce which reflects the diversity of our customers, and communities, in which we live and serve.

Air Canada thanks all candidates for their interest; however only those selected to continue in the process will be contacted.

📌 Partner, Product Security (Dorval)
🏢 Air Canada
📍 Dorval