Team Lead, AppSec

Role Description

As Team Lead, AppSec, you'll take the reins of Forward's application and product security program at a pivotal moment, as we scale our use of AI to build software faster than ever. You'll lead a team of senior engineers, modernize how we pentest and remediate vulnerabilities, and make sure security keeps pace with an engineering organization that increasingly builds with, and builds, AI agents.

• Lead application and product security across Forward-built, third-party, and AI-built software.
• Evolve the pentest program: aggressively security-test and remediate existing software, then continuously test net-new agents and the software agents create.
• Proactively build and integrate AI solutions within the appsec function.
• Own remediation workflows and vulnerability management with Engineering, including pre-production vs. post-production gap analysis.
• Partner with other teams to build controls to contain external exposure: network allowlists, egress proxy, and proxy-level DLP.
• Support the test-to-production review process so AI-built work is security-reviewed before promotion.
• Grow and develop a team of senior engineers; set quality and coverage standards for offensive testing.
• Build and maintain security services within the Forward application stack.

Qualifications

• Typically has 7 or more years in application security, offensive security, or product security, including team leadership.
• Hands-on pentesting and code-review depth across web applications, APIs, and cloud infrastructure (AWS).
• Experience building or scaling a security testing program — scoping, tooling, cadence, and remediation SLAs.
• Understanding of AI/LLM attack surface: prompt injection, insecure agent tool use, and vulnerabilities characteristic of AI-generated code.
• Experience with modern programming languages such as Ruby, Python, or Go, and with secure SDLC practices.
• Ability to communicate risk and priorities crisply to engineers and executives.
• Typically has a Bachelor's Degree in Computer Science or equivalent technical degree, or equivalent industry experience.

Requirements

• Experience pentesting or red-teaming LLM applications and agentic systems.
• OSCP/OSWE or comparable offensive certifications.
• Experience running bug-bounty or external testing programs.
• Background in fintech or other regulated environments.

Benefits

• Annual Targeted Salary: $175,000-$200,000 CAD
• Annual Target Bonus: 12%
• Comprehensive total rewards package, including but not limited to: medical, dental, vision, a flexible time-off policy, paid parental leave, RRSP match, wellness reimbursement, volunteering days, annual professional development budget, and charitable donation match.
• Remote-first company with workplace flexibility a top priority.
• Opportunities for in-person collaboration at premiere office locations.