Advanced Defensive -Applications Security Engineer

Who We Are Looking For

The Advanced Defensive – Application Security Engineers is a member of a small team tasked with securing the firm’s most critical network environments and applications. The Advance Defensive – Application Security Engineer is responsible for secure design, development, and testing of systems and the evaluation of system security throughout the system’s development life cycle. You must be ready to work collaboratively across the team, learning new skills and forging new procedures, relationships, and methods.

Remote work options will be considered for highly skilled candidates.

• Interpret architecture diagrams and controls to enhance the security of new and existing systems.
• Develop application and system cybersecurity designs to meet specific operational needs and environmental factors (e.g., access controls, automated applications, networked operations, high integrity and availability requirements, multilevel security/processing of multiple classification levels, and processing Sensitive Compartmented Information).
• Determine the impacts if vulnerabilities or exploited or a system is compromised.
• Determine the application teams’ lifecycle support requirements.
• Implement application cybersecurity policies using policy as code, automation, and documented and verified manual procedures.
• Implement automated measures to determine the effectiveness of system cybersecurity measures.
• Develop cybersecurity risk profiles for systems.
• Work with developers to create system prototypes using UAT and prototype models.
• Determine if hardware, operating systems, and software adequately addresses a system’s cybersecurity requirements.
• Design and ensure implementation of system backup and failover capabilities.
• Create system testing and validation procedures and documentation.
• Develop system security design documents.
• Develop system recovery and continuity plans.
• Test recovery and continuity plans.

The following knowledge and experiences will help you succeed in this role:

• Minimum of 5 years of experience in full-stack application development across the entire application life cycle.
• Experience designing and deploying payment systems, classified systems, or other critical environments.
• Experience in embedding technical security policies, principles, and standards within applications and network segments.
• Experience developing automated testing to ensure systems are functioning properly or are secure.
• Experience advising development teams on various issues.
• Experience presenting to and advising executives.
• Knowledge of secure software development, deployment, and maintenance.
• Knowledge of agentic AI systems, and their use in system and application development.
• Knowledge of computer network protocols.
• Knowledge of system design tools and techniques.
• Knowledge of server administration and principles and practices.
• Knowledge of database systems.
• Knowledge of Identity Access Management principles including application and API authentication, OAuth
  2.0, and JWT tokens.
• Knowledge of encryption algorithms (e.g., RC4, AES, PQC)
• Knowledge of key management.
• Knowledge of secure system architecture principles and designs.
• Knowledge of secure software engineering principles and practices.
• Knowledge of enterprise information technology (IT) architecture principles, practices and reference models.
• Knowledge of systems engineering processes, principles and practices.
• Knowledge of cyber security threat actors TTPs, tradecraft, and noteworthy attacks.
• Knowledge of cybersecurity principles and practices, including defense in depth.
• Awareness of compliance, including aligning detection strategy with global financial regulations, ISO 27001, EU GDPR, PCI-DSS, EU DORA, SOX, NIST CSF, US OCC Part 30 Safety and Soundness Standards, and financial compliance frameworks.
• Knowledge of application and network segment security reviews and threat modeling, including code reviews and dynamic testing.
• Knowledge of managing and performing application security vulnerability management.
• Knowledge of implementing security controls into cloud environments.
• Knowledge of human error probabilities (HEPs) and performance…