Lead web application security engineering from Canada, combining ModSecurity expertise with AI-assisted vulnerability response and automation. Protect websites against critical threats before exploitation spreads.

This lead security engineering role owns an end-to-end vulnerability response pipeline. You will analyze vulnerabilities, generate and validate WAF rules, and guide a small analyst team. The work extends WordPress security automation to ModSecurity and Coraza while connecting engineering, QA, automation, and marketing.

Key Responsibilities:

- Own vulnerability intake, triage, analysis, testing, release, and disclosure
- Extend protection from WordPress plugins to ModSecurity and Coraza
- Write, review, and refine SecLang security rules
- Build automated tests using exploits, traffic,



and legitimate requests
- Lead analysts and improve response performance metrics

Requirements:

- At least five years of web or application security experience
- Solid ModSecurity, SecLang, OWASP CRS, or comparable WAF experience
- Deep knowledge of common web application attack classes
- Strong Python, regular expression, CI/CD, and testing skills
- Ability to analyze PHP code, advisories, patches, and diffs

Apply web security leadership, Python automation, and WAF engineering to improve accurate protection against critical vulnerabilities.

📌 Lead Web Application Security Engineer (Montreal)
🏢 Jobgether
📍 Montreal