Who you are

- AppSec Experience: 3–5+ years of dedicated experience in Application Security and/or full stack development, with proven experience

- Technical Depth: Practical background conducting secure code assessments for Java and Python applications

- Tooling &
- Automation: Deep familiarity integrating SAST/DAST tools (e.g., GitHub Advanced Security, ZAP/BURP, Synopsys/Veracode, Semgrep and similar tools) into modern CI/CD systems

- Vulnerability &

- Program Management: Hands-on experience operating bug bounty programs and setting program metrics/KPIs

- Threat Modeling: Practical experience applying frameworks like STRIDE to complex systems

- Cooperative Mindset: Exceptional communication skills with a track record of building trust across engineering teams

- BA/BS degree
- A knack for out-of-the-box thinking that thrives in a quick-paced startup workplace

- Prior experience in cloud-native, high-growth, or pre-IPO fintech startups

- Hands-on experience with AWS security controls and cloud infrastructure

- Comfortable navigating fully remote, globally distributed work environments.’

- We're looking for passionate professionals who take pride in their craft and want to help grow a team tackling some of the most critical problems in payments. People who thrive here are curious by nature, unafraid of hard problems, and motivated by the chance to build something that matters at scale

- If you're driven to make a meaningful impact, work at the leading edge of payment technology, and grow your career alongside a team that values ownership, collaboration, and continuous learning, you'll feel right at home at VGS

What the job involves

- As an Application Security Engineer,



you will partner directly across Security and Engineering to build a friction-free, developer-centric security program

- You will shape our Secure SDLC, automate security guardrails in our CI/CD pipelines, scale our private bug bounty program, and foster a strong culture of security champions across a globally distributed team

- Automate Security Controls: Integrate proactive security tooling (SAST, DAST, SCA) directly into CI/CD pipelines (GitHub/GitLab) to catch vulnerabilities before code hits production

- Define &
- Drive Secure SDLC: Design, communicate, and maintain developer-friendly SDLC processes, frameworks, and threat modeling practices (e.g., STRIDE)

- Manage Bug Bounty &

- Triage: Spearhead our private bug bounty program—tracking spends, triaging reports, and lowering Mean Time to Mitigation (MTTM)

- Build Engineering Capability: Share best practices through secure coding training and cultivate a Security Champions network across Engineering

- Lead AppSec Reviews: Conduct threat models and code reviews for Java and Python microservices

- Amplify Security Culture: Partner with external communications to author technical blogs, manage vulnerability disclosures, and showcase VGS’s security engineering

Benefits

- Competitive health benefits including medical, dental, & vision insurance

- VGS stock options
- 401k plan, with employer matching 4% and immediate vesting of employer match

- Life & disability insurance

- Pre-tax flexible spending accounts (dependent and healthcare FSA)

- Flexible work hours and flexible PTO

- 11 US company holidays

- Eligibility for health benefits starts on Day 1!

- New hire home office set up allowance

- Professional learning reimbursement

📌 Application Security Engineer (Canada)
🏢 Very Good Security
📍 Canada