Senior Application Security Engineer

Arrowstreet Capital is hiring a Senior Application Security Engineer to embed application security controls across the software development lifecycle and CI/CD pipelines.

• Manage and improve pipeline security posture by building a modern Dev Sec Ops  ecosystem that uses secure workflows and vulnerability management across the development lifecycle.
• Modernize vulnerability management by integrating AI-driven analysis that maps technical risk to business impact for more informed prioritization and remediation.
• Explore and implement responsible AI use to enhance vulnerability discovery, code review, threat modeling, risk prioritization, security monitoring, and remediation recommendations.
• Lead threat modeling and security reviews for AI-enabled systems
  , including risks such as prompt injection, insecure handling of model outputs, sensitive data disclosure, model abuse, excessive agency, and data or model poisoning.
• Define metrics and reporting that communicate the security posture and risk exposure of AI-enabled applications to technical teams and senior leadership.
• Define and maintain secure SDLC policies, procedures, and workflows
  , translating them into actionable technical requirements.
• Drive security controls in CI/CD pipelines
  , including SAST, DAST, SCA, secret detection, container scanning, and API testing
  .
• Partner with development teams to explain findings, risks, and remediation steps, guiding fixes using an internal risk matrix that ties attack vectors to business objectives.
• Advance software supply chain security with dependency governance, artifact integrity,
  SBOM adoption
  , and third-party risk management
  .
• Improve pipelines with automated vulnerability and risk measurement, and implement promotion guardrails that balance effective risk management with delivery speed.
• Support incident response for application and pipeline security events.

• Ability to leverage frontier AI models to enhance secure code scanning, vulnerability discovery, and application penetration testing.
• Experience in application security
  , Dev Sec Ops ,
  secure SDLC
  , vulnerability management
  , or security engineering
  .
• Experience building advanced dashboards for key risk indicators, trends, and actionable insights for technical and business stakeholders.
• Hands-on experience collaborating with developers to remediate vulnerabilities
  .
• Proficiency with CI/CD platforms and source control tools, including Git Hub, Git Lab, Azure Dev Ops, Jenkins
  , etc.
• Use experience with application security testing tools:
  SAST, DAST, SCA, container scanning, API testing
  , etc.
• Experience conducting security reviews of application architectures and APIs to identify design weaknesses, vulnerabilities, and potential attack paths.
• Familiarity with modern architectures such as microservices
  , containers
  , APIs
  , and cloud-native apps
  .
• Programming/scripting experience:
  Python, Power Shell, Bash, C#, Java, JS/TS, Ruby
  , etc.
• Working knowledge of AWS/Azure cloud security concepts
  .
• Experience developing technical documentation and secure coding guides.
• Effective communication of technical security concepts.
• Strong collaboration and relationship-building skills.
• Ability to influence secure development practices and drive adoption.
• Adaptability to pivot strategy or priorities when facing technical challenges or evolving scope.
• Risk-based mindset that accounts for both business and delivery needs.
• Initiative and independent leadership with strong project management.
• Analytical and detail-oriented with excellent problem solving.
• Thrives in fast-paced, multi-team environments.
• Metrics-driven approach to program effectiveness.
• Clear written and verbal communication of vulnerabilities and remediation.
• Passion for enabling secure development through automatio…