Senior DevSecOps & Application Security Lead

Arrowstreet Capital, Limited Partnership; Boston (MA); On-site; USD 110,000 - 315,000; Full time

Job summary

Arrowstreet Capital, Limited Partnership is seeking an experienced Application Security Engineer to drive secure software practices across CI/CD, DevSecOps, and vulnerability management. You will collaborate with engineering, DevOps, cloud, and product teams to embed security controls throughout the development lifecycle.

You will develop secure development standards, automate vulnerability discovery, define risk metrics, and guide remediation priorities.

Qualifications

• Experience in application security, DevSecOps, secure SDLC, vulnerability management, or security engineering.
• Experience building dashboards with risk indicators for technical and business stakeholders.
• Hands-on collaboration with developers to remediate vulnerabilities.

Responsibilities

• Build and improve pipeline security across DevSecOps and vulnerability management.
• Integrate AI-driven analysis to prioritize risks based on business impact.
• Advance vulnerability discovery, code review, threat modeling, and remediation.
• Lead security reviews for AI-enabled systems and address risks like prompt injection.
• Define metrics and reporting on security posture for leadership.
• Maintain secure SDLC policies and translate into technical requirements.
• Drive security controls in CI/CD (SAST, DAST, SCA, secret detection, container scanning).
• Support incident response for application and pipeline security events.

Skills

Application security

DevSecOps

Secure SDLC

Vulnerability management

Security engineering

CI/CD tooling

SAST

DAST

SCA

Container scanning

APIs security

Python

PowerShell

Cloud security

AWS

Azure

Tools

GitHub

GitLab

Azure DevOps

Jenkins

SAST tools

DAST tools

SCA tools

Container scanning tools

Job description

Arrowstreet Capital, Limited Partnership is seeking an experienced Application Security Engineer to drive secure software practices across CI/CD, DevSecOps, and vulnerability management. You will collaborate with engineering, DevOps, cloud, and product teams to embed security controls throughout the development lifecycle.

You will develop secure development standards, automate vulnerability discovery, define risk metrics, and guide remediation priorities.