Senior Application Security Engineer

Secure Arch Re applications and supporting operations by shaping application security throughout the SDLC.

Responsibilities

• Use application development, deployment, and security experience to guide Application Security strategy and strengthen the secure software development lifecycle (SDLC)
• Configure and improve AppSec tooling and integrations, including SAST configuration, ignore lists, dashboards, and controls that maintain useful coverage without excessive noise
• Lead API, Container, and Application Security testing, including DAST and other validation capabilities, to improve coverage, surface vulnerabilities, and support timely remediation
• Develop security strategies for current and emerging technologies, including containers, serverless, API, and AI/ML
• Embed AI-specific security checks into SDLC reviews and code analysis, covering input/output handling, AI-exposed APIs, prompt and response guardrails, and abuse or data-exfiltration paths
• Provide hands-on support for security incidents, threat events, vulnerability management, and control improvements to strengthen enterprise application security posture
• Collect and report application security metrics to drive insights into security coverage, risk reduction, and program maturity
• Create and maintain technical standards, operational procedures, and documentation for Application Security services using guidance from NIST, OWASP, and SANS
• Deliver technical training to development and cloud engineering teams on secure development practices for API, Container security, and vulnerability remediation
• Implement, optimize, and operationalize Application Security solutions to improve risk visibility, security coverage, and developer adoption
• Drive automation and security capabilities that improve developer experience, streamline security processes, and align AppSec solutions with technology and business goals
• Stay current on emerging Application Security trends, technologies, attack techniques, and industry best practices to continuously enhance Arch Re’s security posture

Requirements

• Undergraduate degree in a related field or equivalent combination of training and experience
• 5+ years of experience in cybersecurity, with significant hands-on application security work
• Experience supporting or leading security reviews for AI-native products, internal agents, or AI-assisted engineering workflows
• Experience performing threat modeling and secure architecture reviews
• Strong experience deploying and operating DAST tools, including team onboarding, authentication setup, and CI/CD integration
• Experience with other well-known application security tools, including SAST and SCA
• Experience with cloud-native Azure and AWS Cloud Platforms
• Strong knowledge of application development, build, and deployment processes (development, IDEs, repositories, branching, pipelines, cloud, containers, serverless, etc.)
• Familiarity with industry standards such as NIST, OWASP, and MITRE
• Relevant certifications in application development, security, application security, DevSecOps, or cloud are a plus
• Experience developing security standards, assessment methodologies, and security review processes

Technologies

• CI/CD
• SAST
• DAST
• SCA
• Azure
• AWS Cloud Platforms
• containers
• serverless
• API
• AI/ML
• SSDLC
• IDE
• repositories
• branching
• pipelines
• prompt and response guardrails
• NIST
• OWASP
• SANS
• MITRE

Benefits

• Multiple medical plans plus dental, vision, and prescription drug coverage
• Competitive 401k with generous matching
• PTO beginning at 20 days per year
• Up to 12 paid company holidays per year plus 2 paid days of Volunteer Time Offer
• Basic Life and AD&D Insurance as well as Short and Long-Term Disability
• Paid Parental Leave of up to 10 weeks
• Student Loan Assistance and Tuition Reimbursement
• Backup Child and Elder Care

Position Summary

• Application Security team secures Arch Re applications and supporting operations through effective solutions, processes, and controls
• Ensures security guardrails are in place to identify risks early and support continuous, secure application delivery
• Requires expertise in CI/CD, secure software development, and application security best practices to enhance the developer experience and improve delivery of security services
• Supports secure-by-design standards, threat modeling, and continuous improvement efforts across the organization

Location and Compensation

• Location: Farmington, CT (onsite)
• Base salary range: USD 127,000 - 172,000 per year
• Total compensation: base salary plus short and long-term incentives; factors include geographic location, scope and responsibilities, qualifications, talent availability, specialization, and business needs
• Range note: base salary range is as of the provided date and may be modified in the future