Senior Product Security Engineer

The application window will close on November 9th, 2026.

The primary work location for this role is remote.

The Product Security Engineering team plays a critical role in protecting Envestnet's Wealth Tech platforms and the sensitive financial data relied upon by advisors, wealth managers, brokerages, banks and RIAs. The team partners closely with product, engineering, architecture, and infrastructure teams to embed security throughout the software development lifecycle, helping ensure that applications, APIs, cloud services, and AI-powered solutions are secure by design.

They lead initiatives spanning application security, Dev Sec Ops , automation, API security, and AI security governance, while driving secure coding practices, threat modeling, vulnerability management, and developer enablement. This is a highly impactful team at the forefront of modern cybersecurity, shaping how security is integrated into innovative financial technology products while enabling the business to deliver trusted solutions at scale.

Responsible for embedding strong security practices into the design, development and operation of Envestnet financial technology platforms. Partners with product management software engineering, architecture and infrastructure teams to identify and mitigate security risks early in the product lifecycle. Defines secure design standards, performs threat modeling and security reviews and helps teams remediate vulnerabilities in applications, APIs and cloud services.

• Identifies application security risks and defines mitigation strategies in various phases of SDLC.
• Performs penetration tests on web applications and collaborates with the development team to resolve identified security issues.
• Performs code review, collaborating with the development team to incorporate secure coding practices across the organization.
• Executes automated scans on web applications using various SAST and DAST tools.
• Analyzes, reviews and suggests new application installations, tests various features and functionalities and collaborates with IT helpdesk through the process of application whitelisting.
• Performs domain audits with the help of OSNIT tools.
• Collaborates with internal and external stakeholders, providing technical support for penetration tests and audit for the products.
• Reviews, evaluates and recommends security best practices for AWS cloud specific implementations of SDLC.
• Collaborates with engineering team on new project initiatives, reviewing and analyzing project requirements and recommending security best practices.
• Performs security audits, reviews security reports, identifies and analyzes legitimacy of bugs to provide security related technical solutions.
• Contributes and suggests ideas for the design of application security tools, standards and architectures.
• Lead the implementation and operation of Application Security tooling and automation, including SAST, DAST, SCA, IAC security, secrets detection, CI/CD security controls, and developer self-service security capabilites.
• Drive Secure SDLC evolution through threat modeling, architecture reviews, code reviews, security testing, and close partnership with development teams to prioritize, remediate, and prevent security vulnerabilities while promoting secure coding practices and developer training.
• Develop and operationalize AI Security and AI-SDLC practices, including governance and security guardrails for AI-assisted development, AI-generated code, AI agents, LLM applications, and sensitive data protection.
• Establish API Security and MCP governance standards, including API discovery, authentication and authorization controls. secure tool integrations, access governance, offensive security testing, and continuous risk of monitoring for APIs, AI agents, and connected systems.

• Strong experience with Application Security tooling, Dev Sec Ops  platforms, CI/CD security controls, and security automation.
• Hands-on experience with threat modeling, architecture reviews, vulnerability management, developer training, and driving remediation with engineering teams.
• Knowledge of AI/LLM security, AI-SDLC frameworks, agentic AI architectures, and AI risk management.
• Familiarity with API Security, MCP governance, tool authorization models, AI agent security, and secure AI integrations.
• Proficiency in Python, Go, Power Shell, or other automation-focused programming languages.
• Candidates should demonstrate the…