Application Security Threat Modeling Engineer

Strengthen Thumbtack products through threat modeling, vulnerability remediation, and secure design as a Canada-remote Application Security Engineer II. Work from Ontario or British Columbia.

This senior application security position partners with Product and Engineering teams to assess risk and shape practical improvements. You will apply secure-by-default patterns, review architectures, and contribute reusable tooling and documentation. The work supports systems, platforms, and developer workflows as Thumbtack scales.

Key Responsibilities:

• Partner with engineering teams to assess application security risks
• Recommend practical, risk-informed security improvements
• Apply approved architectures and secure-by-default patterns
• Participate in application security design reviews and threat modeling
• Contribute to cross-functional security initiatives within defined scopes

Requirements:

• At least four years of relevant software or security experience
• Experience with threat modeling and vulnerability remediation
• Knowledge of authentication, authorization, and secrets management
• Ability to reason about tradeoffs and make sound recommendations
• Interest in application and cloud infrastructure security

Use threat modeling, secure architecture reviews, and risk assessment to help Thumbtack reduce application security risk across Canada.