Partner, Product Security

Job summary

The Partner, Product Security leads security engagement across digital products, serving as the primary point of contact for Cybersecurity and GRC. They are responsible for embedding secure-by-design practices, managing threat modeling, and overseeing security posture throughout the product lifecycle.

Job details

Being part of Air Canada is to become part of an iconic Canadian symbol, recently ranked the best Airline in North America. Let your career take flight by joining our diverse and vibrant team at the leading edge of passenger aviation. The Partner, Product Security leads product security engagement across a portfolio of digital products and platforms, serving as the single point of entry into Cybersecurity & GRC for security support across IT, Data, & Digital (IDD). Partnering closely with product, engineering, and architecture teams, the incumbent ensures security is embedded throughout the product lifecycle - from ideation through to production deployment. Leveraging the organization's agentic capabilities, this role owns threat modeling, risk management, and secure-by-design practices, balancing delivery velocity against risk reduction. The Partner also provides security posture leadership for assigned portfolios and drives consistent application of secure SDLC controls and governance. This position may be located in Montreal or Toronto. Responsibilities: Own the product security posture for an assigned portfolio of products and platforms Lead security engagement across the full product lifecycle, from ideation through production Drive and oversee threat modeling for new and existing products, using agentic tooling to scale coverage and reduce manual effort Partner with product managers and engineering leads to embed secure-by-design practices into delivery workflows Provide risk-based security guidance during architecture and design reviews Ensure secure Product Development Lifecycle controls are implemented and consistently applied across development teams Track and manage security risks, vulnerabilities, and remediation priorities to closure Establish and govern secure usage patterns for agentic development tools and AI gateways, including guardrails for AI-assisted coding, prompt and model access controls, and data handling Assess the security implications of AI-enabled and agentic capabilities introduced into products, including third-party models, agents, and integrations Support security assessments for new technologies, integrations, and third-party solutions Collaborate with Enterprise and Solution Architecture teams to apply reference security patterns Provide oversight and direction to Product Security Advisors (where applicable) Facilitate security decision-making and risk acceptance discussions with product and business stakeholders Monitor security posture metrics and maturity improvements across the portfolio Coordinate security testing activities, including penetration testing and automated scanning Promote developer enablement through security education, guidance, and reusable patterns Participate in architecture review boards and product governance forums Identify and deliver opportunities to automate and standardize security controls, applying agentic and AI-assisted approaches where they improve speed, consistency, or coverage Support continuous improvement of the product security operating model Work closely with Enterprise Architecture, Cloud, and DevOps teams, as well as across Cybersecurity & GRC Bachelor’s degree in Information Technology, Computer Science, Engineering, or related field Minimum 8–10 years of IT experience with at least 3–5 years in security, architecture, or application development Experience with secure SDLC practices and threat modeling Knowledge of application, API, cloud, and data security principles Experience working with Agile / product-based delivery models Strong stakeholder management and communication skills Ability to influence technical teams without direct authority Experience working in large-scale enterprise environments Security certifications (CISSP, CSSLP, CCSP, or equivalent) Experience with DevSecOps tooling and CI/CD pipelines Familiarity with OWASP, NIST SSDF, or similar frameworks Experience in cloud-native architectures (AWS, Azure) Demonstrate punctuality and dependability to support overall team success in a fast-paced environment. Assets: Hands-on experience with agentic development tools such as Anthropic's Claude Code, OpenAI Codex, GitHub Copilot, or comparable platforms Experience designing, securing, or operating AI gateways and associated access, logging, and data-protection controls Familiarity with emerging AI/LLM threat models and secure patterns for agent-based systems Conditions of Employment: Candidates must be eligible to work in the country of interest at the time any offer of employment is made and are responsible for obtaining any required work permits, visas, or other authorizations necessary for employment. Prior to their start date, candidates will also need to provide proof of their eligibility to work in the country of interest. Linguistic Requirements Based on equal qualifications, preference will be given to bilingual candidates. Diversity and Inclusion Air Canada is strongly committed to Diversity and Inclusion and aims to create a healthy, accessible and rewarding work environment which highlights employees’ unique contributions to our company’s success. As an equal opportunity employer, we welcome applications from all to help us build a diverse workforce which reflects the diversity of our customers, and communities, in which we live and serve. Air Canada thanks all candidates for their interest; however only those selected to continue in the process will be contacted.

What you’ll do

The Partner, Product Security leads security engagement across digital products, serving as the primary point of contact for Cybersecurity and GRC. They are responsible for embedding secure-by-design practices, managing threat modeling, and overseeing security posture throughout the product lifecycle.

Requirements

Candidates must possess a Bachelor’s degree in IT, Computer Science, or Engineering and have 8–10 years of IT experience with 3–5 years in security or architecture. Proficiency in secure SDLC, cloud-native architectures, and stakeholder management is essential for this role.

Listed skills

• Risk Management · Preferred
• Stakeholder Management · Preferred

Other relevant skills

Identified from the job description. Confirm important requirements above.

• Product Security
• Cybersecurity
• GRC
• Threat Modeling
• Risk Management
• Secure SDLC
• Cloud Security
• API Security
• DevSecOps
• CI/CD Pipelines
• AI Gateways
• Stakeholder Management
• Architecture Review
• Penetration Testing
• Automated Scanning
• Governance
• Influencing Skills
• GitHub Copilot
• Cloud-Native Architecture
• Certified Cloud Security Professional (CCSP)
• CI/CD
• Ideation
• OpenAI
• Workflow Management
• IT Security Architecture
• Access Controls
• Application Programming Interface (API)
• Agile Methodology
• Aviation
• Amazon Web Services
• Application Development
• Automation
• Microsoft Azure
• Multilingualism
• Certified Information Systems Security Professional
• Decision Making
• Communication
• Computer Science
• Information Technology
• Continuous Improvement Process
• Security Controls
• Cyber Security
• Information Privacy
• Data Security
• DevOps
• Programming Tools
• Governance Risk Management And Compliance
• Leadership
• Enterprise Architecture
• Product Lifecycle Management

Job areas

• Technology
• Security & Safety
• Software
• Management & Leadership
• Data & Analytics
• Security Product Manager
• Cyber Security Architect
• Database and Network Professionals Not Elsewhere Classified
• Information Security Engineers
• Computer Occupations, All Other

More jobs from Air Canada