---
title: 'Staff Application Security Specialist at Workleap - en'
canonical: 'https://feeny.ai/job/staff-application-security-specialist-workleap-en-canada-5484r8erpas4'
type: 'job'
last_seen: '2026-09-07'
---

# Staff Application Security Specialist at Workleap - en

- **Company:** Workleap - en
- **Location:** Canada
- **Work type:** remote
- **Posted:** 2026-04-22
- **Last confirmed live:** 2026-09-07
- **Apply:** https://job-boards.greenhouse.io/workleap/jobs/5111568007

## Job description

Company Description

Workleap is a Montreal-based tech company, founded in 2006. We're builders at heart, we make simple products that actually matter to the people who use them. We have two product lines: [Workleap Agent](https://workleap.com/), our newest solution built to make every manager more effective, and [ShareGate](https://sharegate.com/), the world's leading solution for Microsoft 365 migration and governance. More than 15,000 companies worldwide trust us to do exactly that. We're intentional about who joins us. If you're the kind of person who gets excited by a hard problem and wants to help shape what comes next, there's a place for you here.

## Your role

You will build the security layer for how Workleap writes software, and then you will teach it to run itself.

Today that means the traditional stack done properly. SAST, DAST, SCA, and secret scanning wired into GitHub Actions so findings land where developers already work, with the noise tuned out rather than tolerated. Threat modeling on architectural changes. Vulnerability intake and triage that closes the loop instead of filling a backlog.

Where it goes next is the actual reason this role exists. We are moving toward agentic security review, where agents perform the first pass on every pull request, reason about the change in context, and escalate what matters to a human. Nobody has fully solved this. Rules engines miss intent, models hallucinate findings, and the gap between the two is where the interesting work is. You will close that gap, and you will decide how much trust the system earns at each step.

You will be a hands on individual contributor. You will write the code.

Your impact:

- Build the security guardrails for AI assisted and agentic development so speed and safety stop being a tradeoff
- Move security review from human bottleneck to automated first pass with human judgment reserved for what is genuinely ambiguous
- Achieve near-zero developer friction on security signals by wiring SAST/DAST/SCA into CI/CD with noise tuned low enough that findings actually get fixed.
- Lead threat modeling on new features and architectural changes
- Drive real remediation of application security vulnerabilities, measured by risk retired and not tickets closed
- Harden Azure environments and deployment patterns alongside Infrastructure SecOps

## Your team

You will join LeapSec and report to the Director of Infrastructure and Security. We're a small team with broad reach covering product security, cloud security, and governance across Workleap and ShareGate. That means your work ships, you own it end to end, and you set the priorities that matter. The scope is real, and so is the autonomy that comes with it.

You will partner closely with the AI SDLC team, which builds the internal platform that lets AI agents operate across the development lifecycle, and with product engineering across the organization.

## What you'll bring

- Five or more years in application security, DevSecOps, or security focused software development, with a real engineering background behind it
- Deep working knowledge of web application security, OWASP Top 10, and CWE Top 25
- Proven experience building security automation into CI/CD pipelines, GitHub Actions preferred
- Built and shipped real agent tooling, not just used it. MCP servers, Claude skills, subagents, and custom tools that other people depend on
- Context engineering as a discipline. Knowing what an agent needs in front of it to reason correctly about a codebase, and what to leave out
- Understanding of the security model of agentic systems themselves. Prompt injection, tool permission scoping, credential handling in agent workflows, and what an agent with repo write access can do when it is wrong
- Proficiency in Python for building tooling, not just scripting around it
- Hands on experience with AI assisted and agentic development workflows and a clear view of where they break
- Solid grasp of Azure services, infrastructure security, and deployment patterns
- The ability to explain a risk tradeoff to an engineer and to an executive in the same week and be understood by both

Strong assets

- Secure code review experience in C#/.NET
- Experience integrating SAST, DAST, SCA, and secret scanning at scale
- Familiarity with OIDC, SAML, and OAuth
- Exposure to SOC2 requirements
- Experience running vulnerability discovery and triage with a developer community

What the job comes with

- Annual bonus program.
- LTIP program, share in Workleap's long-term growth.
- RRSP + Family health insurance + telemedicine + annual wellness budget.
- Flexible vacation policy.
- Remote work, with access to our Montreal office.
- In-person gathering twice a year.
- Claude access, for everyone.

What drives us

At Workleap, we build software that sits at the center of how people experience work, every day, at every level.

We move fast. Priorities shift, decisions get made with the information we have, and we iterate. If you thrive on intensity and ambiguity doesn't slow you down, you'll feel right at home. We're builders. We do what it takes to move forward. AI is part of our toolkit. We use it to go faster and decide smarter, not to replace judgment.

If you want real impact and a place where your decisions matter, this is it.

## How we hire

Transparency is how we hire — for you as much as for us.

Here's how it works: a first call with a recruiter, then a virtual interview with the hiring manager. You'll then complete a take-home case study, followed by a meet with future colleagues to discuss it together. Depending on the role, the process may vary slightly — your recruiter will walk you through it on your first call.

We use AI to support certain steps of the process, but every hiring decision remains human.

We can't wait to meet you.

By applying, you confirm that you have read and agree to our [privacy policy](https://workleap.com/trust-center/privacy).

#LI-Remote

## About Workleap - en

## Company Overview
- **One-liner**: Workleap is an AI-powered talent management platform that brings engagement, performance, and compensation into one connected system for small to mid-sized businesses.
- **Entity Type**: Private (Growth stage, series not publicly disclosed)
- **Headquarters**: Montreal, Quebec, Canada
- **Founded**: 2006
- **Founders**: Simon De Baene, Guillaume Roy, Sébastien Leduc

## Core Business
- **Primary Industry**: Human Resources Technology (HR Tech), Employee Experience, Talent Management
- **Target Customers**: SMBs and growing businesses with small or generalist HR teams (B2B)
- **Mission**: "To make work simpler" and help HR leaders ignite employee potential and boost business results.

## Products & Services
- **[Workleap Platform](https://workleap.com/)**: An AI-powered HR suite that includes employee engagement surveys (Officevibe), performance reviews (Performance), and compensation management (Compensation). Designed as a unified system to replace fragmented HR tools.
- **[ShareGate](https://workleap.com/)**: A Microsoft 365 migration and governance solution for IT professionals, focused on simplicity and security. Operates as a separate product line under the Workleap umbrella.

## Market Standing
- **Valuation**: Not publicly disclosed.
- **Key Metrics**: 70,000+ leaders worldwide use Workleap; 20,000+ companies across the entire customer base; 375+ employees.
- **Notable Investors/Partners**: Not specifically listed. Investors are not publicly disclosed.
- **Growth Signals**: Significant customer growth (from "over 70,000 leaders" on the about page), investment in AI features (manager agent, survey summaries), and expansion of the ShareGate product line. The company has a remote-first talent model, hiring across Canada.

## Competitive Advantages
- **Purpose-built for Small HR Teams**: Workleap is designed specifically for smaller or generalist HR teams that lack the resources of enterprise HR departments, offering simple, high-adoption tools.
- **Unified AI Platform**: Combines engagement, performance, and compensation in one system, reducing the "DIY chaos" and clunky legacy tools common in HR tech.
- **High User Satisfaction**: Praised on G2 for fast implementation, ease of use, and high adoption rates.
- **Strong Market Position in M365 Ecosystem**: ShareGate is a leading tool for Microsoft 365 migration and governance, providing a strong, separate revenue stream and brand recognition among IT professionals.

## Strategic Focus
- **AI-First Management Agent**: Developing a proactive "manager agent" that drafts 1:1 agendas, surfaces signals, and helps drive performance reviews, making great management a repeatable process.
- **Product Expansion**: Continuing to unify engagement, performance, and compensation into a single, intelligent platform.
- **Remote-First Culture**: Committed to a remote-first policy (work from anywhere in Canada, up to 150 days abroad annually) with twice-yearly in-person gatherings, aiming to attract top talent without geographic constraints.
- **ShareGate Growth**: Scaling the ShareGate product line for M365 administration and security.

## Why Work Here
- **Remote-First & Flexibility**: Work from anywhere in Canada; work up to 150 days per year abroad. Office in Montreal is optional except for two annual in-person gatherings. [workleap.com](https://workleap.com/careers)
- **Comprehensive Benefits**: Group insurance, $1,300 health & wellness allowance, telemedicine & EFAP, financial support for new parents, home office allowance, internet reimbursement, and delivered meals. [workleap.com](https://workleap.com/careers)
- **Competitive Compensation**: Competitive salary, annual performance bonuses, 5% RRSP contribution, and referral bonuses. [workleap.com](https://workleap.com/careers)
- **Learning & Growth**: Training, conferences, language courses, and a focus on career development.
- **Engineering Culture**: Emphasis on written, asynchronous communication; proactive communication principles; and a strong focus on sustainable, high-performance collaboration. [workleap.com](https://workleap.com/careers)
- **Values-Driven**: "Walk the talk" on employee experience, with a strong internal focus on caring for own team before serving customers.

## Sources
1. [Workleap About Page](https://workleap.com/about)
2. [Workleap Careers Page](https://workleap.com/careers)
3. [Workleap Job Board (Greenhouse)](https://job-boards.greenhouse.io/workleap)
4. [Workleap Homepage](https://workleap.com/)
5. [Workleap LinkedIn](https://ca.linkedin.com/company/workleaphq)

## Other roles at Workleap - en

- [Marketing Operations Analyst (RevOps) - ShareGate](https://feeny.ai/job/marketing-operations-analyst-revops-sharegate-workleap-en-canada-e5a2pg1eyj26) — Canada
- [Sales Manager, New Business — Workleap](https://feeny.ai/job/sales-manager-new-business-workleap-workleap-en-canada-f66b6gn96k80) — Canada
- [Account Manager - Mid-Market - Workleap (12-month Contract)](https://feeny.ai/job/account-manager-mid-market-workleap-12-month-contract-workleap-en-canada-3darx3n6hwjc) — Canada
- [Sales Development Representative — ShareGate](https://feeny.ai/job/sales-development-representative-sharegate-workleap-en-canada-k031nqkcw2a4) — Canada
- [Senior Manager, Demand Generation - Sharegate](https://feeny.ai/job/senior-manager-demand-generation-sharegate-workleap-en-canada-05dam0t8k0xg) — Canada
- [Senior Fullstack Developer (C#/React), Migrate - ShareGate](https://feeny.ai/job/senior-fullstack-developer-c-react-migrate-sharegate-workleap-en-canada-ptdzn138wcf7) — Canada
- [Manager, Revenue & Order to Cash - Finance](https://feeny.ai/job/manager-revenue-order-to-cash-finance-workleap-en-canada-4pc9dn4ba2v5) — Canada