Senior Application Security Engineer

Arrowstreet Capital’s Cyber Security team is hiring a Senior Application Security Engineer to embed application security controls across the software development lifecycle and CI/CD pipelines. The role focuses on improving pipeline security posture, modernizing vulnerability management, advancing software supply chain security, and supporting application and pipeline security incident response.

Key Responsibilities

• Manage and enhance pipeline security posture by building a modern DevSecOps ecosystem that uses scalable workflows and vulnerability management across the development lifecycle.
• Modernize vulnerability management by integrating AI-driven analysis that correlates technical risk with business impact to enable more informed prioritization and remediation.
• Explore and implement responsible use of AI to strengthen vulnerability discovery, code review, threat modeling, risk prioritization, security monitoring, and remediation recommendations.
• Lead threat modeling and security reviews for AI-enabled systems, including risks such as prompt injection, insecure model output handling, sensitive data disclosure, model abuse, excessive agency, and data or model poisoning.
• Define metrics and reporting to communicate security posture and risk exposure of AI-enabled applications to technical teams and senior leadership.
• Define and maintain secure SDLC policies, procedures, and workflows, translating them into actionable technical requirements.
• Drive security controls in CI/CD pipelines, including SAST, DAST, SCA, secret detection, container scanning, and API testing.
• Partner with development teams to explain findings, risks, and remediation steps, guiding remediation using an internal risk matrix of attack vectors and business objectives.
• Advance software supply chain security through dependency governance, artifact integrity, SBOM adoption, and third-party risk management.
• Improve development pipelines with automated vulnerability and risk measurement, including promotion guardrails that balance risk management with delivery speed.
• Support incident response for application and pipeline security events.

Required Qualifications

• Ability to leverage frontier AI models to enhance secure code scanning, vulnerability discovery, and application penetration testing.
• Experience in application security, DevSecOps, secure SDLC, vulnerability management, or security engineering.
• Experience building advanced dashboards that highlight key risk indicators, trends, and actionable insights for technical and business stakeholders.
• Hands-on experience collaborating with developers to remediate vulnerabilities.
• Proficiency with CI/CD platforms and source control tools such as GitHub, GitLab, Azure DevOps, and Jenkins.
• Use of application security testing tools, including SAST, DAST, SCA, container scanning, and API testing.
• Experience conducting security reviews of application architectures and APIs to identify design weaknesses, vulnerabilities, and potential attack paths.
• Familiarity with modern architectures such as microservices, containers, APIs, and cloud-native applications.
• Programming and scripting experience (Python, PowerShell, Bash, C#, Java, JS/TS, Ruby, etc.).
• Working knowledge of AWS/Azure cloud security concepts.
• Experience developing technical documentation and secure coding guides.
• Effective communication of technical security concepts, including written and verbal updates on vulnerabilities and remediation.
• Strong collaboration and relationship-building skills, with the ability to influence secure development practices and drive adoption.
• Demonstrated adaptability, including the ability to pivot strategy or priorities when technical challenges or scope changes arise.
• Risk-based mindset with attention to business and delivery needs, alongside initiative and independent project leadership.
• Analytical, detail-oriented problem solving with a metrics-driven approach to program effectiveness.
• Thrives in fast-paced, multi-team environments.
• Passion for enabling secure development through automation, training, and scalable processes.
• Familiarity with frameworks and standards such as NIST, CIS, ISO 27001, SOC 2, and PCI DSS.
• Some knowledge of application security risks and frameworks including OWASP Top 10 and CWE/SANS 25, secure coding, and threat modeling.

Additional Qualifications (Preferred / Plus)

• Experience leading or maturing application security or DevSecOps programs is a plus.
• Developer-first tools and integration (pull requests, issue tracking, IDEs) is preferred.
• Software supply chain security (SBOM, dependency governance, artifact signing) is a plus.
• Threat modeling methodologies such as STRIDE, attack trees, or agile models.
• Experience with containers and cloud-native platforms (Docker, Kubernetes, ECS/EKS/AKS/OpenShift) is desired.
• Providing application security and secure coding training is an added value.
• Relevant certifications (CSSLP, CISSP, GWAPT, GWEB, OSWE, AWS/Azure Security) are an asset.

Salary and Location

Location: Boston, MA (onsite)

Base Salary Range: USD 110,000 - 315,000 per year.

About the Role and Team

• Join the Cyber Security team to advance application security closely aligned with vulnerability management initiatives.
• Collaborate with development, DevOps, cloud, infrastructure, and product teams to embed security controls throughout the software development lifecycle and CI/CD pipelines.
• Develop and refine secure development standards, strengthen pipeline security, automate vulnerability discovery and testing, and build scalable processes for risk remediation.
• Help guide vulnerability management priorities, deliver reporting and measurement of security risks, and provide actionable guidance and training to engineering teams.

Work Authorization and Compensation Notes

Arrowstreet Capital’s total compensation approach includes base salaries and annual discretionary bonuses, along with a robust benefits package. Base salary placement within the listed range varies based on relevant experience and qualifications, responsibilities and scope, level of the position, and other relevant factors. The range is an estimate, and additional compensation details will be shared during the recruitment process.

Accommodations

Arrowstreet Capital is committed to working with and providing reasonable accommodations for qualified individuals with disabilities. If you need an accommodation during any part of the employment process, contact the company to discuss the nature of your request and provide contact information.