# Application Security Engineer IIAI SummaryThumbtack is hiring an Application Security Engineer II to help embed secure-by-default practices into product architectures, platforms, and developer workflows. The role focuses on identifying and remediating application risks, conducting design reviews and threat modeling, and creating reusable security tooling and documentation. The engineer will partner closely with product and engineering teams, contribute code to address vulnerabilities, and participate in incident response. Candidates need at least four years of software engineering and/or application security experience, strong OWASP knowledge, and practical expertise in authentication, authorization, secrets management, and secure design. This is a Canada-remote role limited to Ontario and British Columbia.

Experience:
SeniorSee how your resume can be rewritten and optimized for this specific job. PRO identifies relevant strengths, missing keywords, and opportunities to present your experience more clearly.Illustrative PRO preview Example output format. Your recommendations will be generated from your resume and this job. Original: Responsible for leading projects and working with different teams.Suggested rewrite: Led a cross-functional initiative that improved [business outcome] by [measurable result], demonstrating experience relevant to this role...
Compare your resume with this job's requirements. PRO highlights your strongest matches, identifies potential gaps, and recommends practical next steps for your application.Illustrative PRO preview Example output format. Your actual assessment will be generated from your resume. 1. Overall Match: A personalized match level with an explanation of how your experience aligns with the role.2. Key Strengths: Skills, achievements,



and experience that support your application.3. Potential Gaps: Requirements that are missing or not clearly demonstrated in your resume.4. Recommendation: Specific improvements to strengthen your application...
Create a personalized cover letter using this job's requirements and the verified experience in your resume. PRO helps connect your strengths with what the employer is seeking.Illustrative PRO preview Example output format. Your letter will be personalized using your resume and this job. Dear Hiring Manager, I am excited to apply for this position. My experience in [relevant area] and track record of [measurable achievement] align with the role's key requirements. I would welcome the opportunity to bring these strengths to your team and contribute to [business objective]...
Opportunity details## About this role.### Thumbtack helps millions of people confidently care for their homes.Thumbtack is the one app you need to take care of and improve your home
- from personalized guidance to AI tools and a best-in-class hiring experience. Every day in every county of the U.
S., people turn to Thumbtack to complete urgent repairs, seasonal maintenance and bigger improvements. We help homeowners know which projects to do, when to do them and who to hire from our growing community of 300,000 local service businesses. If making an impact inspires you, join us.



Imagine what we'll build together.### About the Cybersecurity TeamThe Security Engineering team at Thumbtack is focused on enabling innovation at scale by making the secure path the easiest path. We believe robust security is not a blocker to velocity, but a force multiplier when it is designed into systems, platforms, and developer workflows from the start.
We partner closely with Product, Engineering, Platform, and Data teams to shape system design, guide architectural decisions, and evolve Thumbtack's security posture as the company scales. Through collaboration, automation, and thoughtful tradeoffs, we help ensure Thumbtack can ship fast, innovate boldly, and maintain customer trust.### The ChallengeAs Thumbtack scales and increasingly incorporates AI-powered features into our products and internal systems, security must evolve without slowing innovation. The number of services, deployment patterns, and data flows continues to grow, and traditional approaches that rely heavily on manual reviews or after-the-fact controls do not scale to meet this need.
Instead, the challenge is to design security into the system itself. This means building secure defaults, paved paths, and reusable building blocks that product and engineering teams can adopt with minimal friction. By embedding security directly into architectures, tooling, and infrastructure, we reduce cognitive load on engineers and enable teams to move quickly and confidently while meaningfully lowering risk.###

What you'll do
* Own and deliver application security work within defined projects or domains. Contribute to cross-functional security initiatives, executing clearly scoped pieces of larger efforts.
* Identify, prioritize, and help remediate application secu

📌 Application Security Engineer II (Canada)
🏢 Jobicy
📍 Canada