Senior Application Security Engineer

The Estée Lauder Companies; New York (NY); On-site; USD 90,450 - 135,000; Full time

Benefits offered by this job

Health insurance

Retirement savings plans

Paid leave

Job summary

Estée Lauder Companies in New York seeks an experienced Application Security professional to lead secure SDLC initiatives, DevSecOps integration, and cloud security across global platforms. You will mentor teams, perform vulnerability assessments, and guide secure coding practices within agile environments, ensuring trust in products and services delivered to clients and partners.

This role emphasizes collaboration with IT, engineering, and security stakeholders to implement threat modeling,

Qualifications

• Good knowledge and understanding of application security vulnerabilities (SANS, OWASP).
• Knowledge of Threat modelling and risk analysis.
• Strong analytical/problem solving skills across multiple dev and security disciplines.
• Understanding of CI/CD pipelines (Bitbucket, Jenkins, JIRA, Artifactory, Nexus).
• Familiarity with microservices architecture and design patterns.

Responsibilities

• Review current security processes in software engineering and optimize them.
• Coordinate and perform vulnerability assessments using automated and manual tools.
• Provide consulting and mentoring to Developers, DevOps, and Software teams for DevSecOps adoption.
• Analyze vulnerability data to identify risks and report findings to management.
• Lead remediation of vulnerabilities within established timeframes.

Tools

Jenkins

Bitbucket

Docker

Kubernetes

REST APIs

Job description

Estée Lauder Companies in New York seeks an experienced Application Security professional to lead secure SDLC initiatives, DevSecOps integration, and cloud security across global platforms. You will mentor teams, perform vulnerability assessments, and guide secure coding practices within agile environments, ensuring trust in products and services delivered to clients and partners.

This role emphasizes collaboration with IT, engineering, and security stakeholders to implement threat modeling,