About us
We are building an AI compliance SaaS platform that helps organizations govern AI agents and AI-driven actions throughout their lifecycle. Our platform supports AI agent registration, risk assessment, approval workflows, version tracking, audit trails and governance evidence. We are building for enterprise customers in highly regulated industries, including the property and casualty insurance ecosystem. Security, privacy, reliability and auditability are foundational product requirements, not afterthoughts. We are looking for a Senior Product Security Engineer to partner directly with the CTO and engineering team to design, implement and continuously improve the security of our platform. What you’ll do Product and application security •⁠ ⁠Lead threat modeling and security architecture reviews for our SaaS platform. •⁠ ⁠Design and validate authentication, authorization, tenant isolation and secure API access. •⁠ ⁠Identify and remediate vulnerabilities across application code, dependencies and infrastructure. •⁠ ⁠Establish secure coding standards and integrate security checks into our development lifecycle. •⁠ ⁠Conduct code reviews for security-sensitive changes and help engineers resolve findings. Cloud and DevSecOps security •⁠ ⁠Establish secure cloud configurations, IAM policies, secrets management and environment separation. •⁠ ⁠Integrate SAST, software composition analysis, secret scanning, container scanning and infrastructure-as-code checks into CI/CD. •⁠ ⁠Improve vulnerability management, security monitoring, incident response and recovery procedures. •⁠ ⁠Help ensure production changes are traceable, controlled and auditable. AI application security •⁠ ⁠Assess risks associated with LLM integrations, prompt injection, tool calling, retrieval-augmented generation and untrusted documents. •⁠ ⁠Design controls to prevent unauthorized actions, cross-tenant data leakage and inappropriate access to sensitive information. •⁠ ⁠Establish security testing approaches for AI-enabled features and agent workflows. •⁠ ⁠Help define appropriate human approval, least-privilege and auditability controls for AI actions.



Enterprise security readiness •⁠ ⁠Help establish a risk-based security program aligned with recognized industry practices. •⁠ ⁠Support preparation for enterprise security assessments and SOC 2 readiness. •⁠ ⁠Produce technical evidence of security controls and support customer security questionnaires. •⁠ ⁠Coordinate with external penetration testers and independent auditors, and track remediation through completion. What we’re looking for •⁠ ⁠Significant hands-on experience in application security, product security or security engineering for production SaaS applications. •⁠ ⁠Strong understanding of web application security, API security, identity and access management, and multi-tenant architectures. •⁠ ⁠Practical experience with threat modeling, secure code review, vulnerability assessment and remediation. •⁠ ⁠Experience securing cloud-hosted applications and CI/CD pipelines. •⁠ ⁠Familiarity with security automation, SAST, SCA, secret scanning and infrastructure security. •⁠ ⁠Ability to communicate security risks clearly to engineers, founders and enterprise stakeholders. •⁠ ⁠A pragmatic mindset: able to balance strong security controls with the delivery needs of a small startup. Valuable additional experience •⁠ ⁠Securing LLM-powered applications, AI agents or tool-using systems. •⁠ ⁠Experience with OWASP ASVS, OWASP Top 10 and relevant AI security guidance. •⁠ ⁠Familiarity with SOC 2, ISO 27001 and enterprise vendor-risk assessments. •⁠ ⁠Experience with regulated industries, financial services or insurance. •⁠ ⁠Experience building security programs in an early-stage company. What success looks like First 90 days •⁠ ⁠Complete a threat model and security architecture assessment.



•⁠ ⁠Establish a prioritized security remediation roadmap. •⁠ ⁠Review critical controls for authentication, authorization, tenant isolation and production infrastructure. •⁠ ⁠Identify gaps in automated security testing and production monitoring. First 6 months •⁠ ⁠Implement repeatable security checks and vulnerability management processes. •⁠ ⁠Validate remediation of critical findings. •⁠ ⁠Establish documented incident response and recovery procedures. •⁠ ⁠Support a credible enterprise security assurance roadmap. Remuneration & Benefits

We offer
a competitive total reward package aligned with Greater Toronto Area (GTA) tech standards for senior engineering talent:
• Competitive Base

Salary:
$140,000 – $180,000 CAD per year, dependent on experience and depth of specialization.
• Equity Grant: Meaningful early-stage stock options package to participate directly in the long-term growth and upside of the platform.
• Comprehensive Group Health & Dental: 100% company-paid extended health coverage including prescription drugs, paramedical services (massage, physio, mental health support), and comprehensive dental coverage.
• Paid Time Off: 3–4 weeks (15–20 days) of paid vacation annually, plus statutory holidays and end-of-year shutdown days.
• Health & Wellness Stipend: $500–$1,000 annual lifestyle spending account for wellness, fitness memberships, or home office ergonomics.
• Workplace Flexibility: Flexible hybrid or work from home model within the GTA, along with home office setup allowance.
• Learning & Professional Development: Annual budget dedicated to security certifications, industry conferences, and training (e.g., AI/LLM security courses). Why join us •⁠ ⁠Work directly with the CTO and influence the platform’s architecture from an early stage. •⁠ ⁠Own meaningful security engineering decisions rather than operating solely as an auditor or policy administrator. •⁠ ⁠Shape security practices for an AI-focused enterprise SaaS product. •⁠ Help establish the security foundation needed to earn the trust of demanding enterprise customers.

📌 Senior Product Security Engineer — Enterprise SaaS (Toronto)
🏢 Habermas Solutions
📍 Toronto