Senior Application Security Engineer

Savvy Wealth • New York, NY

1d • $220,000 - $235,000 • Onsite

About The Position

Savvy Wealth is a rapidly growing, AI-forward wealth management company that is reinventing the financial advisor experience. We are a Series B company with over 500% year-over-year growth, backed by significant funding and recognized as a Certified Great Place to Work. We are seeking a Senior Application Security Engineer to join our NYC headquarters. This is a hands-on engineering role focused on identifying and remediating vulnerabilities in our product and SaaS tools, with a particular emphasis on securing AI-assisted development. This role is purely technical security work, not compliance-focused.

Requirements

• 5+ years of hands-on security engineering experience, with significant time in application security or product security
• Strong software engineering fundamentals; comfortable reading, writing, and remediating code, not just filing findings
• Deep experience with the modern AppSec toolchain: secrets scanning, SCA/dependency scanning, SAST, and CI/CD security integration (GitHub-centric)
• Practical experience securing SaaS environments: OAuth and third-party app review, configuration hardening, and least-privilege access design
• Working knowledge of cloud security across AWS and/or GCP, and edge/CDN security (Cloudflare)
• A pragmatic, risk-based mindset: you prioritize by what actually gets exploited, ship iteratively, and avoid drowning teams in noise
• Strong perspective on AI-assisted development security: you understand how AI coding tools change the shape of AppSec risk (hallucinated dependencies, leaked secrets, insecure patterns at scale) and how to build guardrails without killing velocity
• Track record of partnering with engineering teams as an enabler, embedding security into existing workflows rather than bolting it on
• Excellent communication skills and ability to work independently in a fast-paced environment
• Strong writing skills; Savvy is a written culture

Nice To Haves

• Experience building security programs at an early-to-mid stage company, taking a function from reactive to systematic
• Experience with SaaS security posture management, CSPM, or identity threat detection
• Familiarity with securing LLM-based tooling, agentic workflows, or internal AI platforms
• Detection engineering experience (SIEM/MDR, high-signal alerting)
• Fintech or financial services environment experience
• Offensive security background (pentesting, bug bounty, red team) that informs how you defend

Responsibilities

• Own vulnerability management end to end: identify, triage, prioritize by real-world risk, and drive remediation to closure across our product, codebases, and cloud infrastructure (AWS, GCP, Cloudflare)
• Build and operate our AppSec tooling pipeline: secrets scanning in CI and at the git layer, SCA/dependency scanning with triage SLAs, and SAST rollout on our most sensitive repos, tuned for signal over noise
• Set and enforce security hygiene standards within our codebases, including code review standards that explicitly account for AI-generated code (authorship transparency, mandatory human review on security-sensitive paths)
• Partner with our internal AI team to design guardrails that keep AI-assisted development, including vibe coding by non-technical builders, safe by default: sanctioned tooling, data handling boundaries, dependency vetting, and secure defaults for AI-built integrations
• Secure the SaaS stack: harden configurations, review OAuth grants and third-party integrations, reduce misconfiguration risk across platforms like Google Workspace, GitHub, Rippling, and Slack
• Help establish conditional access and identity-layer controls in partnership with IT (SSO, phishing-resistant MFA, managed-device posture)
• Define cloud and SaaS configuration baselines for the infrastructure footprint we operate
• Contribute to detection and response readiness: high-signal detections (new OAuth grants, mass code-host downloads, credential anomalies) and participate in incident response when needed
• Work cross-functionally with Engineering, IT, and the internal AI team; clearly articulate risk, remediation paths, and tradeoffs to both technical and non-technical stakeholders

Benefits

• Competitive salary and equity package
• Unlimited PTO + paid company holidays
• Access to holistic medical, dental, and vision plans
• Company 401(k), Commuter, and HSA/FSA plans
• NYC office in the heart of Manhattan
• Lunch and snacks provided in the office
• Access to virtual mental health care (Spring Health), vision related benefits (XP Health), and health concierge (Rightway) to help you find the right care
• Access to counseling for stress management, dependent care, nutrition, fitness, legal, and financial issues (Guardian WorkLifeMatters EAP)

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed