Application Security Engineer

The D. E. Shaw & Co., L.P. Information Security team in the Systems group is hiring a hands-on Application Security Engineer to work as an individual contributor. In this role, you will partner closely with developers to design secure solutions and build automated, AI-enabled application security workflows and guardrails that help teams move faster with confidence.

What You’ll Build and Operate

• Design, build, and operate agentic security workflows that continuously review code changes, leveraging existing analyzers and custom analysis to investigate findings and propose fixes.
• Create evaluations, feedback loops, and guardrails to assess false positives, missed vulnerabilities, and the safety of proposed fixes, using known test cases and expert review.
• Use OIDC and other web security concepts to inform secure identity and access handling as part of application and workflow design.

How You’ll Support Secure Shipping

• Lead security and design reviews for new and existing software, collaborating directly with developers to surface vulnerabilities and recommend practical remediation.
• Embed secure coding practices alongside development teams to strengthen the Secure Development Lifecycle (SDLC).
• Represent Information Security to engineering teams, translating findings into clear, actionable guidance for technical stakeholders and, when needed, non-technical stakeholders.

Agentic AI Security, Up Close

• Help secure the firm’s use of agentic AI by assessing how developer agents and internal AI platforms handle identity, data access, and tool execution.
• Bring fluency in AI-enabled engineering work, including the risks associated with agentic applications and experience using AI SDKs to build applications or agents.

Qualifications

• 5+ years of experience in application security, product security, security engineering, or software engineering with a strong security focus.
• Bachelor’s degree in computer science or a related technical discipline (advanced degrees in relevant specialties, such as cryptography, are welcome).
• Advanced knowledge of web application security fundamentals, including web protocols, authentication and identity standards (e.g., OIDC), browser security behavior, and applied encryption basics.
• Proven track record building security software such as product features, internal tools, custom scanners, or analysis capabilities, rather than only deploying or operating off-the-shelf tools.
• Hands-on experience finding and mitigating vulnerabilities in complex systems through secure design review, code review, or penetration testing.
• Familiarity with modern software development practices and workflows.
• Sound judgment and clear communication, with the ability to make security decisions independently.

Compensation and Benefits

• USD 225,000 - 300,000 per year
• Variable compensation via a year-end bonus, guaranteed in the first year of hire
• Medical and prescription drug coverage
• 401(k) contribution matching
• Wellness reimbursement
• Family building benefits
• Charitable gift match program