Application Security Engineer - ADR

State Street•Quincy, MA

2d•$120,000 - $202,500

About The Position

State Street’s Cyber Security Architecture & Engineering team is seeking an experienced professional in Application Security (AppSec), Application Detection and Response (ADR), and DevSecOps. The role designs, implements, and supports ADR capabilities to provide visibility into application-layer threats, attacks, and vulnerabilities across the enterprise application portfolio. It requires hands-on expertise in application security, threat detection, incident response, secure software development lifecycle (SSDLC), and runtime application protection and monitoring technologies, as well as close partnership with development, engineering, and cybersecurity teams. The successful candidate will help shape the organization’s ADR strategy and integrate runtime monitoring and threat detection into its broader AppSec and DevSecOps programs. The role includes deploying and operationalizing ADR platforms, investigating application-layer events, collaborating on remediation, developing detection and response workflows, integrating ADR with incident response, and communicating security reporting to technical and executive audiences. It also contributes to documentation, audit support, process improvement, and strategic security projects. The position requires a bachelor’s degree in IT, computer science, or a related field and six years of relevant experience. The advertised annual salary range is $120,000–$202,500 for the primary location; the applicable range may differ for employees working elsewhere. Employees are eligible for State Street’s benefits program, including retirement savings, insurance coverage, paid time off, an Employee Assistance Program, and incentive compensation eligibility. The company also describes inclusive development opportunities, flexible work-life support, paid volunteer days, and employee networks.

Requirements

Bachelor’s degree in information technology, computer science, or a related field.
Six years of relevant experience.
Strong software development background with technologies such as Java, .NET, Python, Node.js, or similar platforms.
Experience with cloud technologies, including Azure and AWS.
Experience in Application Security disciplines, including SAST, DAST, SCA, API Security, Container Security, and Secure SDLC practices.
Experience implementing or supporting ADR, RASP, WAAP, API Security, threat detection, or related application security technologies.
Strong understanding of attack techniques targeting web, mobile, cloud-native, and API-based applications, including OWASP Top 10, API security risks, and advanced threat scenarios.
Experience analyzing application telemetry, logs, traces, and security events to identify malicious activity and investigate incidents.
Experience with automation and orchestration technologies such as Ansible, Terraform, and Kubernetes, and Infrastructure as Code practices.
Technical solutioning experience with Agile Development, DevOps, Cloud Engineering, Cloud Security, Application Security, Threat Detection, Incident Response, and Cybersecurity.
Excellent verbal and written communication skills, including the ability to communicate with technical, operational, and executive audiences.
Ability to prioritize and manage multiple initiatives, operational responsibilities, incidents, and projects simultaneously.
Experience in software development and the secure software development lifecycle (SDLC).
Experience with application security tooling and its operations in modern CI/CD environments and with DevSecOps best practices.
Experience partnering with development communities to influence adoption of application security best practices and tooling.

Nice To Haves

Current information security certifications such as CISSP, GCIH, GWAPT, or equivalent are highly desirable.
Security+ or another cybersecurity security certification.
Experience with Agile and Scrum practices.

Responsibilities

Help define and build the organization’s Application Detection and Response (ADR) strategy, integrating runtime application security monitoring and threat detection into broader Application Security and DevSecOps programs.
Partner with Engineering, Security Operations, Cloud Security, and Application Development teams to implement and operationalize ADR technologies and processes.
Lead deployment, onboarding, and operational support of ADR platforms, including integration with enterprise applications and security tooling.
Monitor, analyze, and investigate application-layer security events, attack patterns, and anomalous behaviors identified through ADR solutions.
Collaborate with application teams to triage, prioritize, and remediate security findings, threats, and attack indicators.
Develop use cases, detection logic, alerting mechanisms, and response workflows to improve threat visibility and reduce response times.
Integrate ADR platforms with incident response processes.
Deliver security reporting, dashboards, metrics, and executive-level summaries concerning application threats, attacks, and remediation activities.
Develop and maintain ADR, AppSec, and DevSecOps documentation, standards, and operational procedures.
Support internal and external audits by providing evidence and documentation and demonstrating adherence to application security monitoring and response processes.
Work with stakeholders to improve application monitoring, detection accuracy, response effectiveness, and security processes.
Provide technical leadership and support for strategic projects through planning, implementation, and operationalization.

Benefits

Retirement savings plan (401K) with company match.
Insurance coverage including basic life, medical, dental, vision, long-term disability, and optional additional coverages.
Paid time off including vacation, sick leave, short-term disability, and family care responsibilities.
Access to the Employee Assistance Program.
Eligibility for annual performance-based incentive awards, excluding certain sales roles subject to sales incentive plans.
Eligibility for certain tax-advantaged savings plans.
Inclusive development opportunities.
Flexible work-life support.
Paid volunteer days.
Employee networks.