Description de posteSenior Java & Application Security Engineer Location Address: Toronto Hybrid: 2-3 days in-office (will increase to 4 days in future) Contract Duration: 6 Months with extension Business group: CIAM Security Engineering We provide the authentication and authorization service for the enterprise customers. Project: CIAM is actively building a more secure and resilient solution as part of our ongoing commitment to strengthening our security posture. As we continue to enhance security by design across the development lifecycle, we are looking for a highly skilled resource who can proactively identify, analyze, and remediate vulnerabilities during the development phase. We are seeking a strong candidate with deep expertise in application and platform security who can address a wide range of vulnerabilities—across code, configuration, dependencies, and architecture—and partner closely with engineering teams to ensure issues are fixed efficiently and effectively. This role will play a critical part in improving the overall security, resilience, and compliance of our applications by embedding secure engineering practices early in the development process. Responsibilities: • Design, develop, and maintain enterprise Java applications using Java 8+ and Spring Boot • Build and enhance microservices using REST APIs and event‑driven patterns • Apply secure coding best practices, including input validation, authentication, and authorization • Participate in architecture and design discussions • Perform code reviews and mentor junior team members • Collaborate with QA, DevOps, DBA, security, and business teams • Troubleshoot production issues and improve application performance and reliability • Contribute to CI/CD pipelines, automated testing, and release readiness • Fix the vulnerabilities found during SAST / DAST / Pen Test. Must have skills: • 8+ years of hands on experience in Java (Java 8 or higher) • Strong expertise in Spring Boot, Spring MVC, Spring Security • Experience designing and consuming RESTful APIs • 3+ years experience with IAM platforms such as ForgeRock • 3+ years Exposure to ForgeRock AM / IDM / Directory Services • Strong experience with SQL and relational databases (Oracle, PostgreSQL, MySQL) • Experience with JUnit, Mockito, and integration testing • Familiarity with CI/CD pipelines, Git, and Agile delivery • Strong understanding of application security fundamentals Nice to have: • Solid understanding of microservices architecture and distributed systems • Understanding of SSO, MFA, and identity integrations • Knowledge of OAuth 2.0, OpenID Connect (OIDC), SAML • Knowledge of secrets management (e.g., HashiCorp Vault) • Experience working in banking or regulated environments • Frontend exposure (React / Angular) is a plus Best VS. Average Candidate: The ideal candidate will be an experienced Java Developer with strong experience with Spring and Oracle. Must have strong understanding of application security fundamentals. Previous experience with ForgeRock is highly preferred.