{"id":1413021,"url":"https://alion.io/job/savvy-wealth-first-dedicated-security-engineer","title":"First Dedicated Security Engineer","company":{"id":4686,"name":"Savvy Wealth","domain":"savvywealth.com","url":"https://alion.io/company/savvy-wealth","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":220000,"max":235000,"currency":"USD","period":"year","gross":null,"usd_annual":235000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"Claude","optional":false},{"name":"Cloudflare","optional":false},{"name":"GCP","optional":false},{"name":"GitHub","optional":false},{"name":"Google Workspace","optional":false},{"name":"Least Privilege","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Slack","optional":false},{"name":"Agentic Workflows","optional":true},{"name":"LLM","optional":true},{"name":"Red Teaming","optional":true},{"name":"SIEM","optional":true}],"status":"live","first_seen_at":"2026-09-28T18:14:15Z","employer_posted_date":"2026-09-28","last_verified_at":"2026-09-30T17:56:10Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"About Savvy Wealth:\nWealth management is a $545 billion industry that still runs on manual work. 75% of advisors offer no digital communication beyond email, and most still build financial plans by hand in Excel. Savvy is reinventing what it looks like to be a financial advisor. Founder Ritik Malhotra saw the fragmentation firsthand after seeking out his own advisor, and started Savvy to give independent advisors a modern, AI-native home.\nSavvy is a registered investment advisor (RIA), and we partner with experienced financial advisors who want to grow without running the back office themselves. Advisors bring their book and join Savvy, running under their own brand (or ours), and Savvy earns a percentage of the assets they manage. In return, they get a true business-in-a-box: a proprietary tech platform and client portal, an in-house marketing team that helps them grow, a world-class investment management team, and a dedicated client services team that runs day-to-day operations and support. Advisors at Savvy service up to 50% more households and save 19 hours a week.\nAI runs through everything we do. On the product side, Savvy Intelligence (released April 2026) is the only AI built for wealth managers that can see a client's complete financial picture. Internally, everyone at Savvy uses Claude and is encouraged to experiment with it, backed by a dedicated AI enablement team and a RevOps org building agents in-house.\nThe trajectory is steep and it's still early. We're a Series C company with 170+ people, $200M raised, and $100M ARR in sight this year. Inc. ranked us the No. 1 fastest-growing financial services company in America in 2026. Come build the next stage with us!\nRecognition:\nWe're a Certified Great Place to Work and have been honored for our culture and our growth:\nNewsweek's America's Greatest Startup Workplaces (2026)\n\nFortune Best Workplaces in New York™ (2026)\n\nGreat Place to Work Certified™ \n\nThe Role\nWe are seeking a Senior Application Security Engineer to join Savvy Wealth at our NYC headquarters as our first dedicated security hire. This is a hands-on, in-the-weeds engineering role. You will execute the security strategy set by our Director of IT & Information Security and our CTO, with day-to-day work centered on identifying vulnerabilities, remediating them, and closing the longer-term gaps that make us exposed, both in our product and in the SaaS tools our teams use every day.\nSavvy is an AI-forward company. Most of our engineering is AI-assisted, and we enable people across the business, including non-technical roles, to build with AI coding tools. That enablement is a core part of how we work, and we intend to keep it. Your job is to make it safe: setting security hygiene standards in our codebases, building guardrails around AI-assisted development, and partnering closely with our internal AI team so that speed and security move together. You will make the secure path the easy path.\nThis role is deliberately not a compliance or GRC position. There are no audits to run, no certifications to chase, and no questionnaires to fill out. This is purely technical security work: finding and eliminating the vectors that make us vulnerable.\nResponsibilities:\nOwn vulnerability management end to end: identify, triage, prioritize by real-world risk, and drive remediation to closure across our product, codebases, and cloud infrastructure (AWS, GCP, Cloudflare)\n\nBuild and operate our AppSec tooling pipeline: secrets scanning in CI and at the git layer, SCA/dependency scanning with triage SLAs, and SAST rollout on our most sensitive repos, tuned for signal over noise\n\nSet and enforce security hygiene standards within our codebases, including code review standards that explicitly account for AI-generated code (authorship transparency, mandatory human review on security-sensitive paths)\n\nPartner with our internal AI team to design guardrails that keep AI-assisted development, including vibe coding by non-technical builders, safe by default: sanctioned tooling, data handling boundaries, dependency vetting, and secure defaults for AI-built integrations\n\nSecure the SaaS stack: harden configurations, review OAuth grants and third-party integrations, reduce misconfiguration risk across platforms like Google Workspace, GitHub, Rippling, and Slack\n\nHelp establish conditional access and identity-layer controls in partnership with IT (SSO, phishing-resistant MFA, managed-device posture)\n\nDefine cloud and SaaS configuration baselines for the infrastructure footprint we operate\n\nContribute to detection and response readiness: high-signal detections (new OAuth grants, mass code-host downloads, credential anomalies) and participate in incident response when needed\n\nWork cross-functionally with Engineering, IT, and the internal AI team; clearly articulate risk, remediation paths, and tradeoffs to both technical and non-technical stakeholders\n\nMust have:\n5+ years of hands-on security engineering experience, with significant time in application security or product security in a small security engineer organization\n\nStrong software engineering fundamentals; comfortable reading, writing, and remediating code, not just filing findings\n\nTrack record of enforcing security across technical and non-technical teams without slowing anyone down. The goal isn't to restrict how people work, it's to keep us safe while they keep working the way they need to.\n\nExperience embedding security into existing workflows rather than bolting it on\n\nDeep experience with the modern AppSec toolchain: secrets scanning, SCA/dependency scanning, SAST, and CI/CD security integration (GitHub-centric)\n\nPractical experience securing SaaS environments: OAuth and third-party app review, configuration hardening, and least-privilege access design\n\nWorking knowledge of cloud security across AWS and/or GCP, and edge/CDN security (Cloudflare)\n\nA pragmatic, risk-based mindset: you prioritize by what actually gets exploited, ship iteratively, and avoid drowning teams in noise\n\nStrong perspective on AI-assisted development security: you understand how AI coding tools change the shape of AppSec risk (hallucinated dependencies, leaked secrets, insecure patterns at scale) and how to build guardrails without killing velocity\n\nExcellent communication skills and ability to work independently in a fast-paced environment\n\nStrong writing skills; Savvy is a written culture\n\nNice to have:\nExperience building security programs at an early-to-mid stage company, taking a function from reactive to systematic\n\nExperience with SaaS security posture management, CSPM, or identity threat detection\n\nFamiliarity with securing LLM-based tooling, agentic workflows, or internal AI platforms\n\nDetection engineering experience (SIEM/MDR, high-signal alerting)\n\nFintech or financial services environment experience\n\nOffensive security background (pentesting, bug bounty, red team) that informs how you defend\n\nBenefits:\nCompetitive salary and equity package\n\nUnlimited PTO + paid company holidays\n\nAccess to holistic medical, dental, and vision plans\n\nCompany 401(k), Commuter, and HSA/FSA plans\n\nNYC office in the heart of Manhattan\n\nLunch and snacks provided in the office\n\nAccess to virtual mental health care (Spring Health) and health concierge (Rightway) to help you find the right care\n\nAccess to counseling for stress management, dependent care, nutrition, fitness, legal, and financial issues (Guardian WorkLifeMatters EAP)","description_format":"text","description_chars":7479,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Unlimited PTO"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Wealth Management & Financial Advisors","Financial Software & Embedded Finance"],"lifecycle":[{"event":"open","at":"2026-09-28T19:39:42Z"}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":22,"reasons":["conf:8","win:early"],"computed_at":"2026-09-30T05:45:00Z"},"pay":{"stated_usd_annual":235000,"is_top_pay":true},"html_url":"https://alion.io/job/savvy-wealth-first-dedicated-security-engineer","json_url":"https://alion.io/job/savvy-wealth-first-dedicated-security-engineer.json","meta":{"generated_at":"2026-10-01T04:11:42Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","usage":{"tier":"crawler","counted_by":"address","units_charged":1,"used_today":3399,"day_limit":5000,"remaining_today":1601,"minute_limit":60,"resets_at":"2026-10-02T00:00:00Z"}}}