Senior Application Security Engineer

Arrowstreet Capital, Limited; Boston (MA); On-site; USD 110,000 - 315,000; Full time

Job summary

Arrowstreet Capital, Limited is seeking an experienced Application Security Engineer to advance software security across the development lifecycle and CI/CD pipelines.

You will collaborate with development, DevOps, cloud, and product teams to embed security controls, modernize vulnerability management, and drive risk-based remediation with measurable metrics.

Qualifications

• Experience in application security, DevSecOps, secure SDLC, vulnerability management.
• Hands-on with CI/CD platforms and SAST/DAST/SCA tools.
• Ability to communicate security concepts to technical and business teams.
• Experience with threat modeling and secure code reviews.
• Familiarity with microservices, containers, cloud-native apps.
• Experience building dashboards showing risk indicators.

Responsibilities

• Lead DevSecOps in CI/CD pipelines and secure development.
• Automate vulnerability discovery, testing, and risk remediation.
• Define and report security metrics to leadership.
• Collaborate with dev, cloud, and product teams to embed security controls.

Skills

CI/CD platforms

SAST

DAST

SCA

Threat modeling

Python

PowerShell

Java

Cloud security

AWS/Azure

Education

Bachelor's degree in CS/Engineering

Tools

GitHub

GitLab

Azure DevOps

Jenkins

Docker

Kubernetes

Job description

Job OverviewJoin our Cyber Security team as an experienced Application Security Engineer, where you’ll play a key role in driving and advancing application security in close alignment with our vulnerability management initiatives. In this senior technical position, you’ll collaborate with development, DevOps, cloud, infrastructure, and product teams to embed security controls throughout the software development lifecycle and CI/CD pipelines.Your responsibilities will include developing and refining secure development standards, strengthening pipeline security, automating vulnerability discovery and testing, and building scalable processes for effective risk remediation. You’ll help guide vulnerability management priorities, deliver meaningful reporting and measurement of security risks, and provide actionable guidance and training to engineering teams, all with a focus on continuous improvement of our overall security posture.ResponsibilitiesManage and enhance pipeline security posture by building a modern DevSecOps ecosystem that leverages innovative workflows and vulnerability management to drive effective, scalable security throughout the development lifecycle.Modernize vulnerability management by integrating AI-driven analysis that correlates technical risks with business impact, enabling more informed prioritization and remediation.Explore and implement the responsible use of AI to improve vulnerability discovery, code review, threat modeling, risk prioritization, security monitoring, and remediation recommendations.Lead threat modeling and security reviews for AI-enabled systems, including risks such as prompt injection, insecure model output handling, sensitive data disclosure, model abuse, excessive agency, and data or model poisoning.Define metrics and reporting that communicate the security posture and risk exposure of AI-enabled applications to technical teams and senior leadership.Define and maintain secure SDLC policies, procedures, and workflows—and translate these into actionable technical requirements.Drive security controls in CI/CD pipelines (SAST, DAST, SCA, secret detection, container scanning, API testing, etc.).Work directly with development teams to explain findings, risks, and remediation steps, guiding vulnerability remediation based on an internal risk matrix of attack vectors and business objectives.Advance software supply chain security, including dependency governance, artifact integrity, SBOM adoption, and third-party risk management.Enhance software development pipelines with automated vulnerability and risk measurement, implementing promotion guardrails that balance effective risk management with delivery speed.Support incident response for application and pipeline security events.QualificationsAbility to leverage frontier AI models to enhance secure code scanning, vulnerability discovery, and application penetration testing.Experience in application security, DevSecOps, secure SDLC, vulnerability management, or security engineering.Experience building advanced dashboards that highlight key risk indicators, trends, and actionable insights for technical and business stakeholders.Hands-on experience collaborating with developers to remediate vulnerabilities.Proficiency with CI/CD platforms and source control tools (GitHub, GitLab, Azure DevOps, Jenkins, etc.).Use of application security testing tools (SAST, DAST, SCA, container scanning, API testing, etc.).Experience conducting security reviews of application architectures and APIs to identify design weaknesses, vulnerabilities, and potential attack paths.Familiarity with modern architectures (microservices, containers, APIs, cloud-native apps).Programming/scripting experience (Python, PowerShell, Bash, C#, Java, JS/TS, Ruby, etc.).Working knowledge of AWS/Azure cloud security concepts.Experience developing technical documentation and secure coding guides.Effective communication of technical security concepts.Strong collaboration and relationship-building skills.Ability to influence secure development practices and drive adoption.Demonstrated adaptability and the ability to pivot strategy or priorities when faced with significant technical challenges or evolving project scopes.Risk-based mindset with attention to business and delivery needs.Initiative and independent leadership with strong project management.Analytical and detail-oriented; excellent problem solving.Thrives in fast-paced, multi-team environments.Metrics-driven approach to program effectiveness.Clear written and verbal communication of vulnerabilities and remediation.Passion for enabling secure development through automation, training, and scalable processes.Familiarity with frameworks/standards (NIST, CIS, ISO 27001, SOC 2, PCI DSS).Some knowledge of application security risks and frameworks (OWASP Top 10, CWE/SANS 25, secure coding, threat modeling).Experience leading or maturing application security/DevSecOps programs is a plus.Developer-first tools and integration (pull requests, issue tracking, IDEs) is preferred.Software supply chain security (SBOM, dependency governance, artifact signing) is a plus.Threat modeling methodologies (STRIDE, attack trees, agile models).Experience with containers and cloud-native platforms (Docker, Kubernetes, ECS/EKS/AKS/OpenShift) desired.Experience providing application security and secure coding training is an added value.Relevant certifications (CSSLP, CISSP, GWAPT, GWEB, OSWE, AWS/Azure Security) are an asset.The base salary range for this position is $110,000 - $315,000 per year.Arrowstreet Capital operates a robust talent acquisition program, and we also seek to compensate and reward our employees competitively within our industry and in line with our merit-based culture. Our approach to total compensation includes base salaries and annual discretionary bonuses, as well as a robust benefits package. The determination of a successful candidate’s base salary placement within the listed range will vary based on the candidate’s relevant experience and qualifications (which may also include relevant certifications, credentials and other education), the job responsibilities and scope, the commensurate resulting level of the position and other relevant factors. The listed range is also an estimate, and additional information regarding base salary and other elements of total compensation offered by Arrowstreet Capital to successful applicants will be communicated during the recruitment process.Arrowstreet Capital is a Boston-based systematic investment firm that manages global equity portfolios for institutional investors around the world.All qualified applicants will receive consideration for employment without regard to sex, race, color, religion, national origin, ancestry, genetic information, age, pregnancy, medical condition, disability, veteran or military status, marital status or any other characteristic protected by federal, state, or local law.Arrowstreet Capital is committed to working with and providing reasonable accommodations for qualified individuals with disabilities and disabled veterans. If you need a reasonable accommodation for any part of the employment process due to a disability, contact us to discuss the nature of your request and contact information.