Staff Security Engineer, Application Security

Toronto, CanadaHybrid

Responsibilities

- Architect secure-by-default patterns, frameworks, and paved roads that developers adopt naturally, removing entire classes of vulnerabilities before they reach production.
- Drive security and product trade-off decisions at the architectural level, balancing protection with velocity.
- Design and implement security controls specific to AI/ML systems, including prompt injection defenses, model input validation, output filtering, and data pipeline integrity.
- Create AI-powered vulnerability detection and security automation that multiplies the team’s effectiveness.
Secure Development & Tooling - Build and maintain security tooling and automation that integrates seamlessly into CI/CD pipelines, enabling continuous security validation at scale.
- Own the vulnerability management program: design modern systems for detection, prioritization, tracking, and remediation of security debt across the product portfolio.
- Own the bug bounty and responsible disclosure program, turning external researcher findings into systemic improvements.

Homebase’s product suite spans scheduling, payroll, time tracking, HR, team communication, and a growing ecosystem of AI-powered features.
That breadth creates fascinating security challenges, from protecting sensitive workforce and financial data to securing the AI models and pipelines that are becoming central to our product experience.
AI Security - Lead threat modeling and security architecture reviews for AI-powered features, model training pipelines, and LLM integrations.
- Partner with AI engineering teams to establish secure development patterns for model deployment and inference infrastructure.
- Stay ahead of the evolving AI threat landscape and translate emerging risks into practical engineering guidance.
experience in Application Security or Security Engineering, with demonstrated impact at the Staff or Principal level. - Deep software engineering
experience in production environments, you write code, build tools, and think like an engineer first. - A proven track record of leading architectural changes and complex cross-team initiatives that reduced security risk at scale. - Hands-on
experience securing AI-native applications, including LLM integrations, model pipelines, or ML infrastructure. - Strong expertise in web application security, cloud-native security (AWS), and modern DevSecOps practices. - Proficiency in languages and frameworks relevant to our stack: Ruby, Python, React, and Rails. -