{"id":1651278,"url":"https://alion.io/job/arrowstreet-capital-senior-application-security-engineer","title":"Senior Application Security Engineer","company":{"id":704902,"name":"Arrowstreet Capital","domain":"arrowstreetcapital.com","url":"https://alion.io/company/arrowstreet-capital","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":91,"open_postings":6,"ghost_share":0,"stale_share":0.167,"repost_share":0,"time_to_fill_p50_days":60,"computed_at":"2026-10-13T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Boston, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":110000,"max":315000,"currency":"USD","period":"year","gross":null,"usd_annual":315000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Azure DevOps","optional":false},{"name":"C#","optional":false},{"name":"CI/CD","optional":false},{"name":"CWE","optional":false},{"name":"GitHub","optional":false},{"name":"GitLab","optional":false},{"name":"ISO 27001","optional":false},{"name":"Java","optional":false},{"name":"Jenkins","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PCI DSS","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Ruby","optional":false},{"name":"SBOM","optional":false},{"name":"SOC 2","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Agile","optional":true},{"name":"Amazon ECS","optional":true},{"name":"Amazon EKS","optional":true},{"name":"Azure AKS","optional":true},{"name":"Docker","optional":true},{"name":"Kubernetes","optional":true},{"name":"OpenShift","optional":true},{"name":"STRIDE","optional":true}],"status":"live","first_seen_at":"2026-10-01T00:00:00Z","employer_posted_date":"2026-10-01","last_verified_at":"2026-10-13T11:32:12Z","board_verified":true,"closed_at":null,"days_open":12,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":12},"description":"Job Overview\nJoin our Cyber Security team as an experienced Application Security Engineer, where you’ll play a key role in driving and advancing application security in close alignment with our vulnerability management initiatives. In this senior technical position, you’ll collaborate with development, DevOps, cloud, infrastructure, and product teams to embed security controls throughout the software development lifecycle and CI/CD pipelines.\nYour responsibilities will include developing and refining secure development standards, strengthening pipeline security, automating vulnerability discovery and testing, and building scalable processes for effective risk remediation. You’ll help guide vulnerability management priorities, deliver meaningful reporting and measurement of security risks, and provide actionable guidance and training to engineering teams, all with a focus on continuous improvement of our overall security posture.\nResponsibilities\nManage and enhance pipeline security posture by building a modern DevSecOps ecosystem that leverages innovative workflows and vulnerability management to drive effective, scalable security throughout the development lifecycle.\nModernize vulnerability management by integrating AI-driven analysis that correlates technical risks with business impact, enabling more informed prioritization and remediation.\nExplore and implement the responsible use of AI to improve vulnerability discovery, code review, threat modeling, risk prioritization, security monitoring, and remediation recommendations.\nLead threat modeling and security reviews for AI-enabled systems, including risks such as prompt injection, insecure model output handling, sensitive data disclosure, model abuse, excessive agency, and data or model poisoning.\nDefine metrics and reporting that communicate the security posture and risk exposure of AI-enabled applications to technical teams and senior leadership.\nDefine and maintain secure SDLC policies, procedures, and workflows-and translate these into actionable technical requirements.\nDrive security controls in CI/CD pipelines (SAST, DAST, SCA, secret detection, container scanning, API testing, etc.).\nWork directly with development teams to explain findings, risks, and remediation steps, guiding vulnerability remediation based on an internal risk matrix of attack vectors and business objectives.\nAdvance software supply chain security, including dependency governance, artifact integrity, SBOM adoption, and third-party risk management.\nEnhance software development pipelines with automated vulnerability and risk measurement, implementing promotion guardrails that balance effective risk management with delivery speed.\nSupport incident response for application and pipeline security events.\nQualifications\nAbility to leverage frontier AI models to enhance secure code scanning, vulnerability discovery, and application penetration testing.\nExperience in application security, DevSecOps, secure SDLC, vulnerability management, or security engineering.\nExperience building advanced dashboards that highlight key risk indicators, trends, and actionable insights for technical and business stakeholders.\nHands-on experience collaborating with developers to remediate vulnerabilities.\nProficiency with CI/CD platforms and source control tools (GitHub, GitLab, Azure DevOps, Jenkins, etc.).\nUse of application security testing tools (SAST, DAST, SCA, container scanning, API testing, etc.).\nExperience conducting security reviews of application architectures and APIs to identify design weaknesses, vulnerabilities, and potential attack paths.\nFamiliarity with modern architectures (microservices, containers, APIs, cloud-native apps).\nProgramming/scripting experience (Python, PowerShell, Bash, C#, Java, JS/TS, Ruby, etc.).\nWorking knowledge of AWS/Azure cloud security concepts.\nExperience developing technical documentation and secure coding guides.\nEffective communication of technical security concepts.\nStrong collaboration and relationship-building skills.\nAbility to influence secure development practices and drive adoption.\nDemonstrated adaptability and the ability to pivot strategy or priorities when faced with significant technical challenges or evolving project scopes.\nRisk-based mindset with attention to business and delivery needs.\nInitiative and independent leadership with strong project management.\nAnalytical and detail-oriented; excellent problem solving.\nThrives in fast-paced, multi-team environments.\nMetrics-driven approach to program effectiveness.\nClear written and verbal communication of vulnerabilities and remediation.\nPassion for enabling secure development through automation, training, and scalable processes.\nFamiliarity with frameworks/standards (NIST, CIS, ISO 27001, SOC 2, PCI DSS).\nSome knowledge of application security risks and frameworks (OWASP Top 10, CWE/SANS 25, secure coding, threat modeling).\nExperience leading or maturing application security/DevSecOps programs is a plus.\nDeveloper-first tools and integration (pull requests, issue tracking, IDEs) is preferred.\nSoftware supply chain security (SBOM, dependency governance, artifact signing) is a plus.\nThreat modeling methodologies (STRIDE, attack trees, agile models).\nExperience with containers and cloud-native platforms (Docker, Kubernetes, ECS/EKS/AKS/OpenShift) desired.\nExperience providing application security and secure coding training is an added value.\nRelevant certifications (CSSLP, CISSP, GWAPT, GWEB, OSWE, AWS/Azure Security) are an asset.\nThe base salary range for this position is $110,000 - $315,000 per year.\nArrowstreet Capital operates a robust talent acquisition program, and we also seek to compensate and reward our employees competitively within our industry and in line with our merit-based culture. Our approach to total compensation includes base salaries and annual discretionary bonuses, as well as a robust benefits package. The determination of a successful candidate’s base salary placement within the listed range will vary based on the candidate’s relevant experience and qualifications (which may also include relevant certifications, credentials and other education), the job responsibilities and scope, the commensurate resulting level of the position and other relevant factors. The listed range is also an estimate, and additional information regarding base salary and other elements of total compensation offered by Arrowstreet Capital to successful applicants will be communicated during the recruitment process.\nArrowstreet Capital is a Boston-based systematic investment firm that manages global equity portfolios for institutional investors around the world.\nAll qualified applicants will receive consideration for employment without regard to sex, race, color, religion, national origin, ancestry, genetic information, age, pregnancy, medical condition, disability, veteran or military status, marital status or any other characteristic protected by federal, state, or local law.\nArrowstreet Capital is committed to working with and providing reasonable accommodations for qualified individuals with disabilities and disabled veterans. If you need a reasonable accommodation for any part of the employment process due to a disability, contact us to discuss the nature of your request and contact information.","description_format":"text","description_chars":7343,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Asset Management & Funds","Hedge Funds & Alternative Investments"],"lifecycle":[{"event":"open","at":"2026-10-02T00:21:25Z"}],"visa":[],"liveness":{"score":89,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.894,"p_room":1,"age_days":12,"expected_fill_days":60,"reasons":["conf:7","velocity","win:early"],"computed_at":"2026-10-13T05:45:00Z"},"pay":{"stated_usd_annual":315000,"is_top_pay":true},"html_url":"https://alion.io/job/arrowstreet-capital-senior-application-security-engineer","json_url":"https://alion.io/job/arrowstreet-capital-senior-application-security-engineer.json","meta":{"generated_at":"2026-10-13T21:18:32Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":32658,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":704902},"rest":"https://alion.io/mcp/rest/get_company?id=704902"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Farrowstreet-capital-senior-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Farrowstreet-capital-senior-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Farrowstreet-capital-senior-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/arrowstreet-capital-senior-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Farrowstreet-capital-senior-application-security-engineer"}]}