Senior DevSecOps & Application Security Lead

Arrowstreet Capital, Limited; Boston; On-site; PHP 9,422,000 - 19,786,000; Full time

Benefits offered by this job

Competitive base salary

Annual discretionary bonuses

Robust benefits package

Job summary

Arrowstreet Capital, a Boston-based investment firm, is seeking an experienced Application Security Engineer to advance our security posture across SDLC and CI/CD pipelines. You will collaborate with development, DevOps, cloud, and product teams to embed security controls and automate vulnerability discovery and remediation, guiding risk-based decisions and leadership reporting.

You will help modernize vulnerability management, define secure SDLC policies, and drive security testing

Qualifications

• Experience with CI/CD security controls (SAST, DAST, SCA, container scanning).
• Experience in security reviews of application architectures and APIs.
• Familiarity with modern architectures (microservices, containers, cloud-native apps).
• Strong communication of security concepts to engineers and leadership.

Responsibilities

• Manage and enhance pipeline security posture across the SDLC.
• Modernize vulnerability management with AI-driven analysis.
• Define and maintain secure SDLC policies and workflows.
• Drive security controls in CI/CD pipelines and incident response for security events.

Skills

Application security

DevSecOps

Secure SDLC

Vulnerability management

Dashboarding & risk reporting

Threat modeling

CI/CD security

Cloud security (AWS/Azure)

Security training

Communication & collaboration

Tools

GitHub

GitLab

Azure DevOps

Jenkins

SAST tools

DAST tools

SCA tools

Container scanners

Job description

Arrowstreet Capital, a Boston-based investment firm, is seeking an experienced Application Security Engineer to advance our security posture across SDLC and CI/CD pipelines. You will collaborate with development, DevOps, cloud, and product teams to embed security controls and automate vulnerability discovery and remediation, guiding risk-based decisions and leadership reporting.

You will help modernize vulnerability management, define secure SDLC policies, and drive security testing