Senior · Assesses risks and remediates vulnerabilities with the support of AI coding agents

About our practice

At CGI in Montréal, our Cloud and Artificial Intelligence practice is experiencing strong growth. We support large enterprises and organizations across industries and sectors in their digital transformation, cloud modernization and generative AI initiatives. By joining our team, you will help design creative, secure and scalable solutions tailored to our clients’ complex challenges.

Your future duties and responsibilities

Responsibilities

- Assess security risks in complex, legacy or poorly documented applications, and define remediation work in collaboration with development, architecture and security teams.
- Analyze and confirm vulnerabilities identified by tools or security reviews, taking into account the code, actual exposure, existing controls and impact on the client’s business operations.
- Prioritize fixes based on risk, technical dependencies and operational constraints; document false positives and residual risks for decisions by the accountable stakeholders.
- Remediate vulnerabilities in code, libraries, dependencies and configurations; resolve compatibility issues associated with upgrades and component changes.
- Use AI coding assistants and agents to accelerate analysis, fix preparation, test creation and documentation, while maintaining rigorous human validation.
- Develop security, regression and integration tests to verify the effectiveness of fixes and confirm that expected functional behaviour is preserved.
- Conduct code reviews and the checks needed to confirm that proposed fixes, including those generated with AI, do not introduce recent vulnerabilities.
- Integrate security controls and fix verification into pull requests and CI/CD pipelines, with acceptance criteria and traceable evidence.
- Prepare and review deployment plans, post-deployment validation in production and rollback procedures, in collaboration with delivery and operations teams.
- Compile remediation evidence, document limitations and residual risks, and share secure development practices and reusable fixes with teams.

Required qualifications to be successful in this role

Required qualifications

- At least 5 years of experience in software development or application security,



with demonstrated experience remediating vulnerabilities in code.
- Robust development and code analysis skills in at least one environment among C#/.NET, Java, Python or JavaScript/TypeScript, including Node.js.
- Proficiency in secure development principles and common application vulnerabilities, including authentication, access control, injection and data protection issues.
- Hands-on experience with static application security testing (SAST), software composition analysis (SCA) and secrets detection tools; ability to interpret and validate their findings.
- Experience upgrading libraries and dependencies, resolving compatibility issues and remediating existing applications.
- Proficiency in automated testing, debugging, Git, code reviews, and continuous integration and delivery practices.
- Demonstrable hands-on experience with at least one AI coding assistant or agent, such as GitHub Copilot, Codex, Claude Code or Cursor, with the ability to verify the security and suitability of its proposals.
- Ability to use AI tools in accordance with requirements for protecting source code, secrets and data, and to recognize situations that require in-depth human analysis.
- Ability to explain risks, work with development teams and produce clear, verifiable evidence of remediation.
- Bilingual in French and English.

Assets
- Experience with remediation programs covering multiple applications or large volumes of vulnerabilities.
- Experience with dynamic application security testing (DAST), threat modelling or application penetration testing.
- Knowledge of software bills of materials (SBOMs), dependency traceability and software supply chain risks.
- Experience securing cloud applications, APIs and containers, or a relevant application security certification.




- Experience delivering solutions in regulated environments or environments with formal validation and remediation evidence requirements.

Compensation and position status CGI provides a reasonable estimate of the pay range for this role, taking into account factors such as skill set, geographic market, experience, training, and licenses and certifications. Compensation decisions depend on the facts and circumstances of each candidate.

Together, as owners, let’s turn meaningful insights into action.

Life at CGI is rooted in ownership, teamwork, respect and belonging. Here, you’ll reach your full potential because…

You are invited to be an owner from day 1 as we work together to bring our Dream to life. That’s why we call ourselves CGI Partners rather than employees. We benefit from our collective success and actively shape our company’s strategy and direction.

Your work creates value. You’ll develop innovative solutions and build relationships with teammates and clients while accessing global capabilities to scale your ideas, embrace new opportunities, and benefit from expansive industry and technology expertise.

You’ll shape your career by joining a company built to grow and last. You’ll be supported by leaders who care about your health and well-being and provide you with opportunities to deepen your skills and broaden your horizons.

At CGI, we value the strength that diversity brings and are committed to fostering a workplace where everyone belongs. We collaborate with our clients to build more inclusive communities and empower all CGI partners to thrive. As an equal-opportunity employer, being able to perform your best during the recruitment process is important to us. If you require an accommodation, please inform your recruiter.

That same commitment to fairness extends to how we use technology. To support our recruitment team, AI tools may be used to help assess applications though they never replace human judgement. All hiring decisions remain entirely in the hands of our recruitment professionals.

To learn more about accessibility at CGI, contact us via email. Please note that this email is strictly for accessibility requests and cannot be used for application status inquiries.

Come join our team—one of the largest IT and business consulting services firms in the world.

📌 Application Security Engineer – AI-Assisted Remediation (Montreal)
🏢 CGI
📍 Montreal