Operate and scale the application security program by maintaining security scanning tools, triaging and validating findings, prioritizing remediation, tracking vulnerabilities to closure, onboarding repositories, and improving documentation and processes. The role also involves communicating vulnerabilities to developers and performing basic Python scripting and automation under senior guidance.
Who we are.
Newfold Digital is a leading web technology company serving millions of customers globally. Our customers know us through our robust portfolio of brands. We have some of the industry's most prominent and storied go-to-market brands, including Bluehost, HostGator, Domain.com, Network Solutions, Register.com and Web.com. We help customers of all sizes build a digital presence that delivers results. With our extensive product offerings and personalized support, we take pride in collaborating with our customers to serve their online presence needs. The strength of our company lives in the intersection of our people, our customers, and our brands.
We're looking for an application security engineer to help run and scale our day-to-day AppSec program. You will help us on our journey to operating our scanning tools, triaging findings, and working directly with engineering teams to get vulnerabilities fixed.
What you'll do & how you'll make your mark.
- Operate and maintain AppSec scanning tools (SAST, SCA, secrets scanning, container scanning) across the SDLC
- Triage findings, validate true positives, and prioritize remediation with engineering teams
- Track vulnerabilities through to closure and monitor SLA compliance
- Support onboarding of new repositories/services into the security tooling
- Contribute to internal documentation, runbooks, and process improvements
- Assist with basic scripting/automation tasks under guidance from senior team members
Who you are & what you'll need to succeed.
- 2–4 years in application security, security engineering, or a related software/QA engineering role
- Working knowledge of common vulnerability classes (OWASP Top 10) and secure SDLC practices
- Basic scripting ability (Python preferred) for automating repetitive tasks
- Comfortable communicating findings clearly to developers
- Strong attention to detail and ability to manage a queue of findings across multiple tools
Nice to have:
- Exposure to Defect Dojo, Dependency-Track, Truffle Hog, Trivy, and/or Semgrep
- Familiarity with CI/CD pipelines and how security scans plug into them
- Interest in growing into tool integration, automation, or custom rule-writing over time
Why you'll love us.
- Work-life balance. Our work is thrilling and meaningful, but we know balance is key to living well.
- We celebrate one another’s differences. We’re proud of our culture of diversity and inclusion. We foster a culture of belonging. Our company and customers benefit when employees bring their authentic selves to work. We have programs that bring us together on important issues and provide learning and development opportunities for all employees. We have 20 + affinity groups where you can network and connect with Newfolders globally.
- We care about you. We are a family, and we care about you and your family’s physical and mental health by providing competitive HMO benefits – 175k MBL with one free dependent upon one year of service! We also give out Punctuality Bonus, Generous Vacation policy, and much more!
- Where can we take you? We’re fans of helping our employees learn different aspects of the business, be challenged with new tasks, be mentored, and grow their careers. Unfold new possibilities with #teamnewfold!
Similar Jobs
Cloud • Legal Tech • Software
Develop and operate application-security automation for vulnerability ingestion, triage, prioritization, and remediation. Integrate CVE, SAST, secret-scanning, penetration-testing, bug-bounty, and IaC findings into unified pipelines. Build AI-assisted security workflows, automated fix processes, data services, dashboards, and scorecards. Partner with engineering teams on vulnerability remediation, root-cause analysis, secure development, and security awareness. Assist with incident response and continuously improve vulnerability management processes.
Top Skills:
AIClaude MythosCloud Security Posture ManagementContainer SecurityContinuous IntegrationData PipelinesDaybreakDependency Vulnerability ScanningInfrastructure-As-Code ScanningJavaScriptLlmsPythonRubySastSecret ScanningSecurity ScorecardsVulnerability Management Platforms
Insurance
Own and improve application security across applications, APIs, cloud services, and CI/CD pipelines. Manage penetration testing programs, vulnerability remediation, security scanning, WAF and API protections, threat modeling, secure design reviews, incident response, and compliance evidence. Partner with developers, vendors, cloud teams, and compliance stakeholders to close critical findings and embed secure delivery practices through automation and security AI tooling.
Top Skills:
AWSCi/CdCloudflare EdgeCloudflare Zero TrustDastDependabotEksGithub Advanced SecurityKubernetesOwasp Top 10PythonQualysSastScaSnykTrivyWaf
Insurance
Own and improve application security across applications, APIs, cloud services, and CI/CD pipelines. Manage penetration testing programs, vulnerability remediation, security scanning, WAF and API protections, threat modeling, secure design reviews, and security automation. Partner with development, cloud, compliance, and security teams to remediate critical findings, support audits, improve secure coding, and provide security guidance. The role also involves leveraging AI-enabled tools for vulnerability triage and remediation.
Top Skills:
AWSCi/CdCloudflare EdgeCloudflare Zero TrustDastDependabotEksGithub Advanced SecurityIso 27001KubernetesOwasp Top 10PythonQualysSastScaSnykSoc 1Soc 2SoxTrivyWaf
What you need to know about the Toronto Tech Scene
Although home to some of the biggest names in tech, including Google, Microsoft and Amazon, Toronto has established itself as one of the largest startup ecosystems in the world. And with over 2,000 startups — more than 30 percent of the country's total startups — Toronto continues to attract new businesses. Be it helping entrepreneurs manage their finances, simplifying business operations by automating payroll or assisting pharmaceutical companies in launching new drugs, the city's tech scene is just getting started.
