Job description

Relay is a digital banking platform that gives self-made business owners the tools and know-how to be great with money—bringing clarity, confidence, and control to every dollar earned, so they can turn hard work into lasting success. We do this by replacing financial guesswork with real visibility, transforming cash flow from a constant source of stress into a clear signal owners can use to run stronger, more resilient businesses. We’re looking for an Senior Application Security Engineer II who thrives on autonomy, curiosity, and impact. You'll join an Application Security team that is deliberately moving away from the advisory model most AppSec functions are stuck in. You’ll work across our stack (from TypeScript and Node.js, to Postgres and AWS cloud infrastructure) ensuring our applications are secure from design to deployment. You’ll blend technical depth with systems thinking, working across teams to identify risks, build guardrails, and evolve our security practices as Relay scales. Your mission is to own at least one AppSec process end to end, guide developers on how to solve challenging security problems and adapt traditional security solutions to the new AI landscape. This is a role with room to grow. You'll be working next to senior engineers who are maintaining our auth system and building our DAST tooling from scratch. The Relay AppSec team genuinely enjoys Application Security and is looking to make an impact on the field. What You'll Be Doing - Threat modeling & offensive testing: Threat model technical design documents (TDDs) and run white-box penetration tests on our testing environment to identify vulnerabilities from an attacker’s point of view. - VDP & bug bounty: Triage researcher reports, reproduce/assess impact, coordinate fixes with owners, and close the loop with clear comms and durable controls. - Shipping the fixes you can: Contributing directly to Relay’s code base when it makes sense — writing the patch, not filing the ticket. - Working in our security tooling and extending it: Datadog security, secrets scanning and logging, Burp Suite, and in-house tools you'll be expected to modify rather than just operate. - Building with AI as a default: Claude Code and Cursor are daily drivers on this team, not a pilot program. - Joining the team's rhythms: Two weekly standups, a biweekly security champions session with product engineers, and a weekly Hack The Box session. - Software supply chain: Enforce provenance: SBOM on every build, dependency pinning/owner verification, private registries/proxies, and runtime SCA detections. Who You Are - You have 5 to 6 years of professional security experience. Application security, penetration testing, or product security engineering or similar roles. - You've shipped production code: Production-level software real users depended on. And you can read an unfamiliar codebase well enough to fix something in it, which is most of this job. - Security fundamentals: Deep understanding of OWASP Top 10 and real-world exploitation/mitigation techniques. - You build with AI. You use AI tooling in your daily work and you've built something with it. You can talk about where it gets things wrong, not just that it's fast. - Clear communicator & collaborator: You are a collaborator who loves to partner with developers to bring value to customers in the most secure way possible. - Ownership: You have a sense of responsibility towards problems and take ownership over them making sure nothing is forgotten and stakeholders stay informed. - Mentorship: You are comfortable mentoring team members and members of other teams on security best practices. The Interview Process - Stage 1: A 45-minute Google Meet call with a member of the Talent team - Stage 2: A 60-minute Google Meet video call with the Hiring Manager - Stage 3: A 60-minute Secure Code Review Interview with two members of our appsec team - Stage 4: A take-home case study, followed by a 60-minute Google Meet video call review with two members of the Engineering team - Stage 5: A 45-minute in-person interview with a member of our leadership team Our Compensation Approach We believe Relayers should feel rewarded for the impact they have on our mission and growth. Compensation follows impact. As impact increases, compensation grows, and we do not limit compensation changes to a once-a-year review cycle. The annual salary range for this role is $180,000 CAD to $220,000 CAD. For candidates who demonstrate full readiness for the defined scope of the role, the typical starting salary is $200,000 CAD. Offers below this point reflect candidates we believe can grow into the full scope of the role with support and development. Offers above this point reflect impact that meaningfully exceeds the role’s defined expectations or an expanded scope from day one. We encourage you to have a conversation with your recruiter and ask questions about compensation throughout the hiring process. For more information on our compensation philosophy and perks and benefits, visit our Candidate Hub notion.so. Why Relay Might Be the Perfect Fit For You - You push relentlessly for reinvention: You're always asking "how can this be better?" -- in your work, in your craft, in yourself. Comfort is a signal to push harder, not coast. You'd rather build something better than defend something familiar. - You crave autonomy: We trust our team with big challenges and the freedom to solve them. If you’re someone who takes initiative, is comfortable taking risks, and seeks input when needed, you’ll find the freedom here empowering. - You own your work: You take pride in your work, follow through on commitments, and feel a deep sense of responsibility for outcomes, not just tasks. - You build with AI, not just use it: You're actively embedding AI into how you work, pushing what's possible, and bringing your team along with you. - You care about impact, not noise: You care deeply about the substance of your work. You measure success by results, not recognition, and you let your work speak for itself. - You’re energized by complexity and ambiguity: You enjoy tackling problems that don’t come with a playbook. You’re comfortable building from scratch, iterating as you go, and collaborating to shape the best path forward. - You seek out feedback: You see directness as respect, not criticism. You actively seek input, sit with hard truths, and use feedback as fuel for improvement. - Small businesses are why we're here: Relay exists to help them thrive -- and that mission has to resonate with you. Join Us We're looking for people who are relentless, curious, and care deeply about the work. You're encouraged to apply even if your experience doesn't perfectly match the job description -- your perspective and drive matter more. We welcome diverse backgrounds and people who think critically, challenge the status quo, and want to help small businesses thrive. If you require accommodations at any stage of the hiring process, please reach out to your Talent Partner. Disclaimer: For compliance reasons, all offers of employment at Relay are conditional upon a successful background check and employment verification through Certn. Important Notice: Relay’s recruitment team only contacts candidates and corresponds from official corporate email addresses ending in @relayfi.com. We will never ask for sensitive personal data (such as bank account details, credit card numbers, or social security/insurance numbers) during the initial application or interview stages.

Requirements

Must-haves

Your mission is to own at least one AppSec process end to end, guide developers on how to solve challenging security problems and adapt traditional security solutions to the new AI landscape.
What You'll Be Doing
Threat modeling & offensive testing: Threat model technical design documents (TDDs) and run white-box penetration tests on our testing environment to identify vulnerabilities from an attacker’s point of view.
VDP & bug bounty: Triage researcher reports, reproduce/assess impact, coordinate fixes with owners, and close the loop with clear comms and durable controls.
Shipping the fixes you can: Contributing directly to Relay’s code base when it makes sense — writing the patch, not filing the ticket.
Working in our security tooling and extending it: Datadog security, secrets scanning and logging, Burp Suite, and in-house tools you'll be expected to modify rather than just operate.
Building with AI as a default: Claude Code and Cursor are daily drivers on this team, not a pilot program.
Joining the team's rhythms: Two weekly standups, a biweekly security champions session with product engineers, and a weekly Hack The Box session.
Software supply chain: Enforce provenance: SBOM on every build, dependency pinning/owner verification, private registries/proxies, and runtime SCA detections.
You have 5 to 6 years of professional security experience. Application security, penetration testing, or product security engineering or similar roles.
You've shipped production code: Production-level software real users depended on. And you can read an unfamiliar codebase well enough to fix something in it, which is most of this job.
Security fundamentals: Deep understanding of OWASP Top 10 and real-world exploitation/mitigation techniques.
You build with AI. You use AI tooling in your daily work and you've built something with it. You can talk about where it gets things wrong, not just that it's fast.
Clear communicator & collaborator: You are a collaborator who loves to partner with developers to bring value to customers in the most secure way possible.
Ownership: You have a sense of responsibility towards problems and take ownership over them making sure nothing is forgotten and stakeholders stay informed.
Mentorship: You are comfortable mentoring team members and members of other teams on security best practices.
The Interview Process
Stage 1: A 45-minute Google Meet call with a member of the Talent team
Stage 2: A 60-minute Google Meet video call with the Hiring Manager
Stage 3: A 60-minute Secure Code Review Interview with two members of our appsec team
Stage 4: A take-home case study, followed by a 60-minute Google Meet video call review with two members of the Engineering team
Stage 5: A 45-minute in-person interview with a member of our leadership team
Our Compensation Approach
Why Relay Might Be the Perfect Fit For You

Nice-to-haves

None flagged.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

typescriptnode.jspostgresawsaigo

Platform: ashby
Effort: quick