Partenaire - Produits - Sûreté

Belonging to Air Canada is belonging to a Canadian icon, Air Canada recently voted best airline in North America. Take your career to new heights by joining our innovative and diverse team at the forefront of passenger air transport.

The Product Security Partner drives product security engagement for a portfolio of digital products and platforms, acting as a single point of contact for Cybersecurity and Governance, Risk and Compliance teams to ensure security support across the IT, Data and Digital Solutions (IDS) branch. Working closely with Product, Engineering, and Architecture teams, the incumbent ensures that security is integrated throughout the product lifecycle, from design to production release. Leveraging the company's agentic capabilities, they will be responsible for threat modeling, risk management, and security-by-design practices, balancing speed to execution with risk reduction. The incumbent also provides leadership on the security posture for their assigned portfolios and promotes the consistent application of controls and governance related to the secure software development lifecycle.

The position can be based in Montreal or Toronto.

Responsibilities:

• Assume responsibility for the product security posture for the assigned product and platform portfolio.
• Lead security efforts throughout the complete product lifecycle, from design to production.
• Drive and oversee threat modeling for new and existing products, using agentic tools to scale coverage and reduce manual efforts.
• Collaborate with Product Leads and Engineering Leads to embed security-by-design practices into delivery workflows.
• Provide risk-based security guidance during architecture and design reviews.
• Ensure that secure product development lifecycle controls are implemented and applied consistently across development teams.
• Track and manage security risks, vulnerabilities, and remediation priorities through to closure.
• Establish and govern secure usage patterns for agentic development tools and AI gateways, including guardrails for AI-assisted coding, prompt and model access controls, and data processing.
• Assess security implications of agentic and AI-enabled capabilities introduced into products, including models, agents, and third-party integrations.
• Support security assessments for new technologies, integrations, and third-party offerings.
• Collaborate with the enterprise Solution Architecture team to apply baseline security patterns.
• Provide oversight and guidance to Product Security Advisors (where applicable).
• Facilitate security decision-making and risk acceptance discussions with Product stakeholders and business stakeholders.
• Monitor security posture metrics and maturity improvement across the portfolio.
• Coordinate security testing activities, including penetration testing and automated scanning.
• Drive developer enablement through security awareness, guidance, and reusable templates.
• Participate in architecture review boards and product governance forums.
• Identify and capture opportunities to automate and standardize security controls, adopting agentic and AI-assisted approaches that improve speed, consistency, or coverage.
• Support continuous improvement of the product safety operating model.
• Work closely with enterprise IT Architecture, Cloud Services, and DevOps teams, as well as all Cybersecurity and Governance, Risk, and Compliance teams.

Qualifications

• Bachelor's degree in information technology, computer science, engineering or a related field.
• At least eight to ten years of IT experience, including at least three to five years in security, architecture, or application development.
• Experience with secure software development lifecycle practices and threat modeling.
• Knowledge of application security, API, cloud, and data principles.
• Experience working with Agile methodology or product-based delivery models.
• Strong stakeholder management and communication skills.
• Ability to influence technical teams without direct authority.
• Experience working in large-scale environments.
• Security certifications (CISSP, CSSLP, CCSP or equivalent).
• Experience with DevSecOps tools and CI/CD pipelines.
• Knowledge of OWASP, NIST Secure Software Development Framework, or similar frameworks.
• Experience with cloud-native architectures (AWS, Azure).
• Demonstrate punctuality and reliability to support the team's overall success in a fast-paced environment.

Assets:

• Hands-on experience with agentic development tools such as Anthropic's Claude Code, OpenAI Codex, GitHub Copilot or similar platforms.
• Experience in designing, securing or operating AI gateways and related access, logging and data protection controls.
• Knowledge of emerging threat models from AI and large language models, as well as secure patterns for agent-based systems.

Employment Conditions:

Candidates must be eligible to work in the country concerned at the time an offer of employment is presented and are responsible for obtaining necessary work permits, visas or other authorizations. Proof of eligibility must be provided prior to the start date.

Language Requirements

Equal skills being equal, preference will be given to bilingual candidates.

Diversity and Inclusion

Air Canada is strongly committed to diversity and inclusion and aims to create a healthy, accessible and rewarding workplace that highlights the unique contribution of our employees to our company's success.

As an equal opportunity employer, we encourage diverse applications so that we can build a workforce that is varied and representative of our customers and the communities where we live and offer our services.

Air Canada thanks all candidates for their interest, but only those selected for an interview will be contacted.