Lead Application Security Engineer — Build Our Security Program

Beacon Software; New York (NY); On-site; USD 180,000 - 240,000; Full time

Job summary

Beacon Software in New York seeks its first dedicated application security engineer to set the strategy for product security and begin building the program. You will embed with Beacon's engineering teams and portfolio companies, owning the roadmap for secure products as Beacon grows.

The role covers design and architecture, threat modeling, code reviews, AI security, vulnerability management, tooling, incident response, and collaboration with GRC to align security with business needs.

Qualifications

• Expert knowledge of web and API security, identity and access design (authentication, authorization, RBAC/ABAC), and applied cryptography.
• Experience securing applications in cloud environments and containerized workloads.
• Track record of driving security work to completion in engineering organizations.

Responsibilities

• Lead secure design and architecture reviews for new product work and platform initiatives.
• Own vulnerability management program including intake, severity, remediation SLAs, and reporting.
• Perform secure code reviews targeting authorization and business logic flaws.
• Oversee AI security across products, including agent architectures and data access.
• Define standards for authentication, authorization, encryption, and tenant isolation.

Skills

App security

Threat modeling

Security architecture

Code review

Cloud security

AI security

RBAC/ABAC

Incident response

Vulnerability management

Automation tooling

Job description

Beacon Software in New York seeks its first dedicated application security engineer to set the strategy for product security and begin building the program. You will embed with Beacon's engineering teams and portfolio companies, owning the roadmap for secure products as Beacon grows.

The role covers design and architecture, threat modeling, code reviews, AI security, vulnerability management, tooling, incident response, and collaboration with GRC to align security with business needs.