Top Benefits
About the role
COMPANY DESCRIPTION
Workleap is a Montreal-based tech company, founded in 2006. We're builders at heart, we make simple products that actually matter to the people who use them. We have two product lines: The Workleap Agent [https://workleap.com/], our agentic HR platform that helps managers become better leaders, and ShareGate [https://sharegate.com/], the world's leading solution for Microsoft 365 migration and governance. More than 15,000 companies worldwide trust us to do exactly that. We're intentional about who joins us. If you're the kind of person who gets excited by a hard problem and wants to help shape what comes next, there's a place for you here.
YOUR ROLE
As a DevSecOps Lead, you will be an operational individual contributor responsible for embedding security directly into our products, pipelines, and development workflows — with a focus on CI/CD, C#/.NET applications, Azure, and AI-driven software delivery. This is a deeply technical role where you will write code, build tooling, and work closely with developers to ensure security is a natural part of how we build and ship software.
You will join the AI-SDLC team, which builds internal platforms and tooling that enable AI agents to operate across the development lifecycle. Your mission will be to ensure that security is integrated from the ground up across these tools, pipelines, and agentic workflows—enabling secure-by-default product development at scale.
Your impact:
- Ensure security is embedded into CI/CD pipelines by delivering scalable, automated tooling and integrated security checks (SAST, DAST, SCA, secret scanning);
- Enable secure-by-default development by designing and implementing automated, policy-driven security review workflows;
- Establish robust security guardrails within AI-assisted development and agent workflows to reduce risk while maintaining developer velocity;
- Reduce risk exposure by proactively identifying, assessing, and driving remediation of application security vulnerabilities;
- Strengthen application security posture by leading threat modeling and security assessments for new features and architectural changes;
- Improve detection and response capabilities through the development of automation, tooling, and streamlined vulnerability management processes;
- Elevate cloud and application security by partnering with Infrastructure SecOps to harden Azure environments and deployment practices;
- Enhance external security feedback loops by contributing to and scaling the bug bounty program and vulnerability intake processes.
YOUR TEAM
You will join the AI-SDLC team, responsible for building the internal platform that enables AI agents to operate across the Workleap and ShareGate development lifecycle. This includes developing agent pipelines, safety mechanisms, and developer-facing tooling. You will work closely with Infrastructure SecOps and partner with multiple product teams across the organization. This is a highly collaborative environment where your impact comes from building scalable solutions and making secure development the default for everyone.
The next challenges awaiting the team revolve around scaling automated security practices across a growing portfolio of SaaS products, while deepening security integration within GitHub Actions and CI/CD pipelines. As AI-assisted and agentic development workflows continue to evolve, ensuring that security guardrails keep pace will be a key priority — alongside strengthening secure-by-default practices and building greater security awareness among developers across teams.
WHAT YOU'LL BRING
- 8+ years of experience in application security, DevSecOps, or security-focused software development;
- Strong software engineering background combined with deep security expertise;
- Deep understanding of web application security principles, OWASP Top 10, and CWE Top 25;
- Hands-on experience performing secure code reviews in C#;
- Experience building and maintaining security automation in CI/CD pipelines (GitHub Actions preferred);
- Solid understanding of Azure cloud services, infrastructure security, and deployment patterns;
- Experience integrating SAST, DAST, SCA, and secret scanning tools into development workflows;
- Proficiency in scripting (Python, Bash) for automation and tooling;
- Extensive hands-on experience with AI-assisted and agentic development workflows, with deep expertise in their security implications; recognized for major contributions in this space and driven by strong curiosity to push the boundaries of AI in the SDLC;
- Familiarity with authentication protocols such as OIDC, SAML, and OAuth;
- Ability to clearly communicate security risks and trade-offs to both technical and non-technical stakeholders.
WHAT THE JOB COMES WITH
- Base salary: $150k to $200k. This range reflects our Canada-wide compensation scale. Final offers may be adjusted based on the candidate's region to align with local market conditions.
- Annual bonus program.
- LTIP program, share in Workleap's long-term growth.
- RRSP + Family health insurance + telemedicine + annual wellness budget.
- Flexible vacation policy.
- Remote work, with access to our Montreal office.
- In-person gathering twice a year.
- Claude access, for everyone.
Please note: this position is posted under the title DevSecOps Lead but carries the official title of Application Security Manager within the organization.
WHAT DRIVES US
At Workleap, we build software that sits at the center of how people experience work, every day, at every level.
We move fast. Priorities shift, decisions get made with the information we have, and we iterate. If you thrive on intensity and ambiguity doesn't slow you down, you'll feel right at home. We're builders. We do what it takes to move forward. AI is part of our toolkit. We use it to go faster and decide smarter, not to replace judgment.
If you want real impact and a place where your decisions matter, this is it.
HOW WE HIRE
Transparency is how we hire — for you as much as for us.
Here's how it works: a first call with a recruiter, then a virtual interview with the hiring manager. You'll then complete a take-home case study, followed by a meet with future colleagues to discuss it together. Depending on the role, the process may vary slightly — your recruiter will walk you through it on your first call.
We use AI to support certain steps of the process, but every hiring decision remains human.
We can't wait to meet you.
By applying, you confirm that you have read and agree to our privacy policy [https://workleap.com/trust-center/privacy].
#LI-Remote
Similar Jobs
Top Benefits
About the role
COMPANY DESCRIPTION
Workleap is a Montreal-based tech company, founded in 2006. We're builders at heart, we make simple products that actually matter to the people who use them. We have two product lines: The Workleap Agent [https://workleap.com/], our agentic HR platform that helps managers become better leaders, and ShareGate [https://sharegate.com/], the world's leading solution for Microsoft 365 migration and governance. More than 15,000 companies worldwide trust us to do exactly that. We're intentional about who joins us. If you're the kind of person who gets excited by a hard problem and wants to help shape what comes next, there's a place for you here.
YOUR ROLE
As a DevSecOps Lead, you will be an operational individual contributor responsible for embedding security directly into our products, pipelines, and development workflows — with a focus on CI/CD, C#/.NET applications, Azure, and AI-driven software delivery. This is a deeply technical role where you will write code, build tooling, and work closely with developers to ensure security is a natural part of how we build and ship software.
You will join the AI-SDLC team, which builds internal platforms and tooling that enable AI agents to operate across the development lifecycle. Your mission will be to ensure that security is integrated from the ground up across these tools, pipelines, and agentic workflows—enabling secure-by-default product development at scale.
Your impact:
- Ensure security is embedded into CI/CD pipelines by delivering scalable, automated tooling and integrated security checks (SAST, DAST, SCA, secret scanning);
- Enable secure-by-default development by designing and implementing automated, policy-driven security review workflows;
- Establish robust security guardrails within AI-assisted development and agent workflows to reduce risk while maintaining developer velocity;
- Reduce risk exposure by proactively identifying, assessing, and driving remediation of application security vulnerabilities;
- Strengthen application security posture by leading threat modeling and security assessments for new features and architectural changes;
- Improve detection and response capabilities through the development of automation, tooling, and streamlined vulnerability management processes;
- Elevate cloud and application security by partnering with Infrastructure SecOps to harden Azure environments and deployment practices;
- Enhance external security feedback loops by contributing to and scaling the bug bounty program and vulnerability intake processes.
YOUR TEAM
You will join the AI-SDLC team, responsible for building the internal platform that enables AI agents to operate across the Workleap and ShareGate development lifecycle. This includes developing agent pipelines, safety mechanisms, and developer-facing tooling. You will work closely with Infrastructure SecOps and partner with multiple product teams across the organization. This is a highly collaborative environment where your impact comes from building scalable solutions and making secure development the default for everyone.
The next challenges awaiting the team revolve around scaling automated security practices across a growing portfolio of SaaS products, while deepening security integration within GitHub Actions and CI/CD pipelines. As AI-assisted and agentic development workflows continue to evolve, ensuring that security guardrails keep pace will be a key priority — alongside strengthening secure-by-default practices and building greater security awareness among developers across teams.
WHAT YOU'LL BRING
- 8+ years of experience in application security, DevSecOps, or security-focused software development;
- Strong software engineering background combined with deep security expertise;
- Deep understanding of web application security principles, OWASP Top 10, and CWE Top 25;
- Hands-on experience performing secure code reviews in C#;
- Experience building and maintaining security automation in CI/CD pipelines (GitHub Actions preferred);
- Solid understanding of Azure cloud services, infrastructure security, and deployment patterns;
- Experience integrating SAST, DAST, SCA, and secret scanning tools into development workflows;
- Proficiency in scripting (Python, Bash) for automation and tooling;
- Extensive hands-on experience with AI-assisted and agentic development workflows, with deep expertise in their security implications; recognized for major contributions in this space and driven by strong curiosity to push the boundaries of AI in the SDLC;
- Familiarity with authentication protocols such as OIDC, SAML, and OAuth;
- Ability to clearly communicate security risks and trade-offs to both technical and non-technical stakeholders.
WHAT THE JOB COMES WITH
- Base salary: $150k to $200k. This range reflects our Canada-wide compensation scale. Final offers may be adjusted based on the candidate's region to align with local market conditions.
- Annual bonus program.
- LTIP program, share in Workleap's long-term growth.
- RRSP + Family health insurance + telemedicine + annual wellness budget.
- Flexible vacation policy.
- Remote work, with access to our Montreal office.
- In-person gathering twice a year.
- Claude access, for everyone.
Please note: this position is posted under the title DevSecOps Lead but carries the official title of Application Security Manager within the organization.
WHAT DRIVES US
At Workleap, we build software that sits at the center of how people experience work, every day, at every level.
We move fast. Priorities shift, decisions get made with the information we have, and we iterate. If you thrive on intensity and ambiguity doesn't slow you down, you'll feel right at home. We're builders. We do what it takes to move forward. AI is part of our toolkit. We use it to go faster and decide smarter, not to replace judgment.
If you want real impact and a place where your decisions matter, this is it.
HOW WE HIRE
Transparency is how we hire — for you as much as for us.
Here's how it works: a first call with a recruiter, then a virtual interview with the hiring manager. You'll then complete a take-home case study, followed by a meet with future colleagues to discuss it together. Depending on the role, the process may vary slightly — your recruiter will walk you through it on your first call.
We use AI to support certain steps of the process, but every hiring decision remains human.
We can't wait to meet you.
By applying, you confirm that you have read and agree to our privacy policy [https://workleap.com/trust-center/privacy].
#LI-Remote