Senior Application Security Engineer

Nomura • New York, NY

93d • $145,000 - $175,000

About The Position

Nomura is a global financial services group with an integrated network spanning approximately 30 countries and regions. By connecting markets East & West, Nomura services the needs of individuals, institutions, corporates and governments through its three business divisions: Wealth Management, Investment Management, and Wholesale (Global Markets and Investment Banking). Founded in 1925, the firm is built on a tradition of disciplined entrepreneurship, serving clients with creative solutions and considered thought leadership. We are looking for a talented and experienced professional to join our team as Senior Application Security Engineer with specific focus on DevSecOps, Dynamic Application Security Testing (DAST, UAT), and related activities. This role will report directly to the Application Security Lead in New York. In this role, you will be part of a team leading the design, development, and implementation of robust and scalable application security solutions to protect Nomura's critical assets. This role is technical and hands-on and requires a deep understanding of application security practices (SAST, SCA, DAST) and generally the secure software development lifecycle (SDLC). You will play a key role in shaping our information security strategy and ensuring the resilience and effectiveness of application security solutions.

Requirements

• Master's or Bachelor's degree in Computer Science, Information Technology, or related fields
• 5+ years of proven information security experience, including expertise in Dynamic Application Security Testing, Static Application Security Testing, Software Component Analysis, OWASP and application security weakness remediation
• Interest in implementing application security principles and secure Software Development Life Cycle (SDLC) practices in a large, global enterprise
• Strong background or keen interest in security frameworks including NIST Cybersecurity Framework (CSF), SANS security guidelines, OWASP security practices
• Professional security certifications preferred and interest in pursuing certifications as part of professional development
• Outstanding analytical and problem-solving capabilities with proven project management experience
• Exceptional interpersonal skills with demonstrated ability to communicate effectively across diverse teams and stakeholder groups

Nice To Haves

• Certified Information Systems Security Professional (CISSP)
• Certified Secure Software Lifecycle Professional (CSSLP)

Responsibilities

• Drive innovation in DevSecOps security automation across a global enterprise environment, implementing cutting-edge solutions and best practices
• Build out and maintain robust Dynamic Application Security Testing Practice
• Manage and Deploy our DAST tool
• Support onboarding and scanning of business applications and related processes
• Validate scans and risk-assess findings (triage, attribution)
• Read out findings to developers and advise on remediation
• Lead strategic partnerships with Application Security development teams to drive adoption of security best practices
• Implement robust security practices throughout the application lifecycle
• Establish security-first development methodologies
• Foster collaborative relationships with key stakeholders to ensure alignment with industry security standards
• Ensure compliance with regulatory requirements
• Implement robust security frameworks
• Adhere to governance protocols

Benefits

• 401(k) eligibility
• various paid time off benefits, such as vacation, sick time, and parental leave
• sign-on bonus
• restricted stock units
• discretionary awards

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Industry: Securities, Commodity Contracts, and Other Financial Investments and Related Activities
• Education Level: Master's degree
• Number of Employees: 5,001-10,000 employees