Senior Application Security Engineer

Arrowstreet Capital•Boston, MA

10d•$110,000 - $315,000

About The Position

Join our Cyber Security team as an experienced Application Security Engineer, where you’ll play a key role in driving and advancing application security in close alignment with our vulnerability management initiatives. In this senior technical position, you’ll collaborate with development, DevOps, cloud, infrastructure, and product teams to embed security controls throughout the software development lifecycle and CI/CD pipelines. Your responsibilities will include developing and refining secure development standards, strengthening pipeline security, automating vulnerability discovery and testing, and building scalable processes for effective risk remediation. You’ll help guide vulnerability management priorities, deliver meaningful reporting and measurement of security risks, and provide actionable guidance and training to engineering teams, all with a focus on continuous improvement of our overall security posture.

Requirements

Ability to leverage frontier AI models to enhance secure code scanning, vulnerability discovery, and application penetration testing.
Experience in application security, DevSecOps, secure SDLC, vulnerability management, or security engineering.
Experience building advanced dashboards that highlight key risk indicators, trends, and actionable insights for technical and business stakeholders.
Hands-on experience collaborating with developers to remediate vulnerabilities.
Proficiency with CI/CD platforms and source control tools (GitHub, GitLab, Azure DevOps, Jenkins, etc.).
Use of application security testing tools (SAST, DAST, SCA, container scanning, API testing, etc.).
Experience conducting security reviews of application architectures and APIs to identify design weaknesses, vulnerabilities, and potential attack paths.
Familiarity with modern architectures (microservices, containers, APIs, cloud-native apps).
Programming/scripting experience (Python, PowerShell, Bash, C#, Java, JS/TS, Ruby, etc.).
Working knowledge of AWS/Azure cloud security concepts.
Experience developing technical documentation and secure coding guides.
Effective communication of technical security concepts.
Strong collaboration and relationship-building skills.
Ability to influence secure development practices and drive adoption.
Demonstrated adaptability and the ability to pivot strategy or priorities when faced with significant technical challenges or evolving project scopes.
Risk-based mindset with attention to business and delivery needs.
Initiative and independent leadership with strong project management.
Analytical and detail-oriented; excellent problem solving.
Thrives in fast-paced, multi-team environments.
Metrics-driven approach to program effectiveness.
Clear written and verbal communication of vulnerabilities and remediation.
Passion for enabling secure development through automation, training, and scalable processes.
Familiarity with frameworks/standards (NIST, CIS, ISO 27001, SOC 2, PCI DSS).
Some knowledge of application security risks and frameworks (OWASP Top 10, CWE/SANS 25, secure coding, threat modeling).

Nice To Haves

Experience leading or maturing application security/DevSecOps programs is a plus.
Developer-first tools and integration (pull requests, issue tracking, IDEs) is preferred.
Software supply chain security (SBOM, dependency governance, artifact signing) is a plus.
Threat modeling methodologies (STRIDE, attack trees, agile models).
Experience with containers and cloud-native platforms (Docker, Kubernetes, ECS/EKS/AKS/OpenShift) desired.
Experience providing application security and secure coding training is an added value.
Relevant certifications (CSSLP, CISSP, GWAPT, GWEB, OSWE, AWS/Azure Security) are an asset.

Responsibilities

Manage and enhance pipeline security posture by building a modern DevSecOps ecosystem that leverages innovative workflows and vulnerability management to drive effective, scalable security throughout the development lifecycle.
Modernize vulnerability management by integrating AI-driven analysis that correlates technical risks with business impact, enabling more informed prioritization and remediation.
Explore and implement the responsible use of AI to improve vulnerability discovery, code review, threat modeling, risk prioritization, security monitoring, and remediation recommendations.
Lead threat modeling and security reviews for AI-enabled systems, including risks such as prompt injection, insecure model output handling, sensitive data disclosure, model abuse, excessive agency, and data or model poisoning.
Define metrics and reporting that communicate the security posture and risk exposure of AI-enabled applications to technical teams and senior leadership.
Define and maintain secure SDLC policies, procedures, and workflows—and translate these into actionable technical requirements.
Drive security controls in CI/CD pipelines (SAST, DAST, SCA, secret detection, container scanning, API testing, etc.).
Work directly with development teams to explain findings, risks, and remediation steps, guiding vulnerability remediation based on an internal risk matrix of attack vectors and business objectives.
Advance software supply chain security, including dependency governance, artifact integrity, SBOM adoption, and third-party risk management.
Enhance software development pipelines with automated vulnerability and risk measurement, implementing promotion guardrails that balance effective risk management with delivery speed.
Support incident response for application and pipeline security events.