Application Security Engineer

PEI Group; United States; Hybrid; USD 120,000 - 170,000; Full time

Benefits offered by this job

25 days annual leave

8 bank holidays

10 days rolling sick leave

Private medical insurance

Life insurance (4x salary)

Pension scheme with matched contrib

Cycle to work scheme

Job summary

PEI Group is seeking an Application Security Engineer to drive vulnerability management and secure product development across IT, Product, Engineering and Cloud Platform teams. You will work with the Information Security and Governance Manager to embed security into design, delivery and DR planning.

The role emphasizes collaboration with third parties for Penetration Testing and staying current on AI security best practices, with participation across PEI's global operations.

Qualifications

• 2+ years AWS architecture and security practices.
• 2+ years vulnerability management experience.
• Ability to communicate security impact to execs/engineers.
• Ability to scope and engage in penetration testing with partners.
• Articulate security use cases to project/sprint leads.
• Desirable: security quality gates for CD in engineering.
• Desirable: 2+ years Azure architecture and security.

Responsibilities

• Manage the Vulnerability Management Programme with reporting.
• Operate security tooling and ensure correct outputs for teams.
• Provide security assurance in system and application design.
• Contribute security input to disaster recovery plans and tests.
• Offer adhoc security guidance to teams as issues arise.

Skills

AWS architecture

Security best practices

Vulnerability management

Communication with execs

Penetration test scoping

Security use cases

Continuous Delivery security gates

Azure architecture

Generative AI safety

Infrastructure as code

Tools

Aws Inspector

Rapid7 Command Center

Snyk

SonarQube/SonarCloud

Job description

About The Role

The security team monitors and supports the security control framework for PEI Media; and engages with third parties to deliver security services in support of that framework. We are a subset of the IT with a reporting line to the Exec team; and as such we engage with numerous stakeholders across the business.

As an Application Security Engineer, you will work closely with the Information Security and Governance Manager to provide security services to the business units, predominantly the IT, Product, Engineering and Cloud Platform teams.

A good share of the work sits around the Vulnerability Management Programme and supporting coders/engineers to deliver secure products and infrastructure.

Responsibilities and Duties

• Manage the Vulnerability Management Programme. Ensure we have relevant coverage and reporting to be able to prioritise vulnerability fixes. Collaborate with the teams to ensure they have the information they need to solve the problem. Work with third parties to deliver a Penetration Testing programme against our critical assets.
• Operate the security tooling that supports the security programme. Ensure the tooling operates correctly and is configured to provide the relevant outputs to the relevant teams.
• Provide security assurance in system and application design. Work with delivery teams to ensure products reflect security requirements in the design stage ; and verify those requirements are delivered.
• Make sure we can recover. Provide security input to disaster recovery plans and tests.
• Support the teams who depend on us. Provide adhoc advice on security issues as they arise.

About You

Qualification & Experience

• A demonstrable understanding over at least 2 years of AWS architecture and services, and security best practises within this environment.
• Practical experience over at least 2 years of understanding vulnerability management programmes.
• A demonstrable ability to communicate the impact of security vulnerabilities to execs or engineers.
• A demonstrable ability to effectively scope Penetration tests and engage with partners in their execution
• A demonstrable ability to articulate security use cases to Project/Sprint team leads
• Desirable: A practical understanding of security quality gates for Continuous Delivery in engineering practises. This equates to how can we use the tooling we have to improve the quality of code in production
• Desirable: A demonstrable understanding over at least 2 years of Azure architecture and services; and security best practises within this environment.

Technical Skills

• A practical understanding of the OWASP methodology for securing code
• A practical understanding of the configuration and outputs from vulnerability management tooling, specifically Aws Inspector, Rapid 7 Command Centre (or similar), Snyk and Sonarqube/Sonarcloud
• Up to date knowledge of Generative AI platforms/Large Language Model and their associated use cases and security best practises.
• Confident with infrastructure as code
• Desirable: An understanding of securing DataBricks configuration
• Desirable: experience of working with AI coding assistants and agents – we use them heavily day to day, so an appetite for it counts for as much as a long track record.

Personal Attributes

• Strong problem solving and real curiosity about how things work
• A good communicator whether verbally or written. Someone that can genuinely engage with colleagues of all levels.
• A genuine appetite for learning unfamiliar platforms.

Benefits UK

• 25 days of annual leave plus 8 bank holidays, with additional leave for long service and a gifted Christmas break
• 10 days rolling sick leave
• Holiday flex option to buy or sell up to 3 days of leave
• Employee incentive reward program (EIRP) tied to future exit events
• 4 paid volunteer days per year
• On site 24/7 gym with classes and full facilities
• Life insurance (4x basic salary) and 24/7 Employee Assistance Programme
• Private medical insurance (post-probation), annual eye tests and DSE eyewear allowance
• Pension scheme with 4.5% matched contributions and enhanced matching over time
• Cycle to work scheme, interest‑free travel loan and employee referral bonus

PEI1

About Us

PEI Group is the leading global provider of business intelligence, data, analytics, and events for private markets professionals.

Through meticulously sourced data, deep analytical expertise, and a trusted journalistic heritage, PEI delivers vital intelligence to sharpen the decision‑making of more than 30,000 investors, asset managers, and service providers.

With over two decades of strong growth, PEI operates across ten asset classes including private equity, private credit, private real estate, and private infrastructure, through our portfolio of premium research platforms, membership networks, and global events.

Our 500‑strong team operating from six offices, equips private market professionals with the relationships, opportunities, and critical market insights they need to navigate evolving markets and achieve stronger investment outcomes.

At PEI we value diverse talent and welcome applications from everyone – regardless of background. We are an equal opportunity employer and our inclusive culture at PEI is reflected in every stage of the recruitment journey. Please inform us at initial stages of the recruitment process if you require any reasonable adjustments and we can accommodate this.

PEI Group supports flexible working arrangements, and we welcome career returners.