Canopy provides a cloud-based practice management platform that helps accounting firms streamline client management, document handling, workflow, and billing.
<p><strong>Senior Application Security Engineer</strong></p> <p><strong>Canopy, South Jordan, UT</strong></p> <p> </p> <p><strong>About Us</strong></p> <p>Canopy is a fast-growing SaaS company in South Jordan, Utah building simple, powerful software for accounting firms. We're on a mission to help accountants build an autonomous firm — giving them back the time and tools they need to focus on what matters most: their clients.</p> <p>We believe the accounting industry deserves world-class software, and we're building exactly that. Our Practice Management Suite is purpose-built for firms that want to work smarter, grow faster, and deliver more value to the people they serve. We place a strong emphasis on delighting our customers, spotting and solving problems, and being good people along the way.</p> <p>Click <a href="https://www.getcanopy.com/why-canopy">here</a> to see why our clients (and investors) love Canopy.</p> <p>Interested in learning more about Canopy & the industry? Check out our blog <a href="https://www.getcanopy.com/blog">here</a> where you can find great information on our product features, industry news, practice management, and more!</p> <p> </p> <p><strong>The Opportunity</strong></p> <p>As we scale, so does the trust our customers place in us to protect their data. We're hiring a Senior Application Security Engineer to help harden our platform — from how we isolate workloads and control access, to how we secure our network, harden our applications, achieve audit-grade observability, and lock down our software supply chain.</p> <p>This is a hands-on, high-ownership role. You'll be a primary builder on a broad security roadmap spanning cloud infrastructure, identity, network, application, observability, and the software supply chain — turning it into shipped, operational reality alongside platform, infrastructure, and product engineering teams. We're looking for someone who can go deep on any one of these areas when needed, while staying comfortable moving across all of them, and who has a sharp read on how AI is reshaping both the threats we defend against and the tools we defend with.</p> <p>This position is fully remote in Utah.</p> <p> </p> <p><strong>What You’ll Do</strong></p> <ul> <li>Help design and execute a multi-year application and platform security roadmap spanning cloud infrastructure, identity, network, application, observability, and the software supply chain</li> <li>Harden our AWS and Kubernetes environments — from account/organization structure and IAM to workload identity, network segmentation, and zero-trust access</li> <li>Strengthen authentication and application-layer defenses, including anti-abuse protections, secure headers, and multi-tenant isolation</li> <li>Build out the security observability stack: audit logging, cloud posture monitoring, runtime threat detection, and deception-based detection techniques</li> <li>Embed security into the SDLC — CI/CD gates, secret scanning, threat modeling, and software supply chain integrity (SBOMs, artifact signing, provenance), accounting for the new risks and review needs introduced by AI-generated code and AI-assisted development workflows</li> <li>Evaluate and adopt AI-powered security tooling — from AI-assisted pentesting and code review to anomaly detection — to help our small team punch above its weight</li> <li>Work closely with the security lead to prioritize this work, balancing finite hardening projects against the ongoing operational load of running a security program that scales with the company</li> <li>Serve as a trusted security resource for engineering teams — reviewing designs, unblocking teams on secure implementation patterns, and helping raise security literacy across the org</li> <li>Support customer and compliance conversations where deep technical credibility is needed</li> </ul> <p> </p> <p><strong>What We’re Looking For</strong></p> <ul> <li>8+ years of professional experience in application security, security engineering, or a closely related discipline, with a track record of driving substantial security initiatives from design through to production</li> <li>Deep, hands-on expertise across most of the following: cloud account/organization security (AWS preferred), IAM and least-privilege design, Kubernetes and container security, network security and zero-trust access (e.g., Tailscale, mTLS), web application security (WAF, CSP, authentication/anti-abuse), security observability (SIEM/audit logging, CSPM, runtime detection), and secure SDLC/supply chain security (SAST/DAST, secret scanning, SBOM, artifact signing)</li> <li>A working understanding of how AI is currently shaping the security landscape — both offensively (AI-assisted phishing, automated exploitation, LLM-specific attack surfaces) and defensively (AI-assisted detection, code review, and pentesting) — and the judgment to separate real risk and real value from hype</li> <li>Demonstrated ability to go deep on a single domain when the problem demands it, and to reason credibly across all of them when setting priorities</li> <li>Experience threat modeling new features and influencing engineering design decisions before code is written</li> <li>Strong communication skills — able to translate security risk into terms that engineers, product managers, and leadership can act on</li> <li>Comfort operating with significant autonomy in a fast-moving environment, and pulling in the right partners across the org to get things done</li> </ul> <p> </p> <p><strong>Bonus Points </strong></p> <ul> <li>Experience securing multi-tenant SaaS platforms, including tenant-isolation testing or red-teaming</li> <li>Relevant certifications (e.g., OSCP, GWAPT, GCSA, or similar) — nice to have, not required</li> <li>Experience building or operating detection engineering programs (honeytokens, canary credentials, runtime threat detection)</li> <li>Prior experience in a regulated or compliance-heavy environment (SOC