{"id":1455005,"url":"https://alion.io/job/simpson-thacher-bartlett-llp-senior-manager-application-security","title":"Senior Manager, Application Security","company":{"id":1842699,"name":"Simpson Thacher & Bartlett","domain":"stblaw.com","url":"https://alion.io/company/stblaw","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":78,"open_postings":17,"ghost_share":0,"stale_share":0.882,"repost_share":0,"time_to_fill_p50_days":24,"computed_at":"2026-10-15T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":190000,"max":220000,"currency":"USD","period":"year","gross":null,"usd_annual":220000},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"Kubernetes","optional":false},{"name":"Platform Engineering","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Threat Modeling","optional":false}],"status":"live","first_seen_at":"2026-06-03T00:00:00Z","employer_posted_date":"2026-06-03","last_verified_at":"2026-10-15T04:33:55Z","board_verified":true,"closed_at":null,"days_open":134,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":134},"description":"JOB SUMMARY\nThe Senior Manager, Application Security is responsible for defining, leading, and operationalizing the firm’s application security program across internally developed applications, SaaS platforms, APIs, databases, generative AI platforms, and emerging application architectures. This role partners closely with application engineering, cloud, and platform teams to embed security into the software development lifecycle while enabling teams to deliver securely at scale.\nThe ideal candidate is a highly skilled, hands-on technical leader who can translate security requirements into practical developer workflows while enabling rapid and reliable software delivery.\nJOB DUTIES & RESPONSIBILITIES\nDevelop, execute, and continuously mature the enterprise application security strategy in alignment with industry best practices, regulatory requirements, and client contractual obligations.\n\nDefine and maintain secure application development standards for internally developed software, third-party applications, APIs, SaaS platforms and containerized workloads.\n\nEstablish minimum security requirements for application authentication, authorization, encryption, secrets handling, and data protection.\n\nDefine, maintain, and enforce secure SDLC and DevSecOps standards across all development teams.\n\nIntegrate application security controls into CI/CD pipelines, developer platforms, and engineering workflows with a focus on automation and scalability.\n\nPartner with Application Engineering and DevOps teams to embed automated security testing and preventive controls while maintaining security ownership of policy and enforcement.\n\nEvaluate, select, implement, and manage the full lifecycle of application security tooling including:\nSAST, DAST, SCA, and API security testing platforms\n\nContainer image scanning and registry security tooling\n\nKubernetes security and runtime protection solutions\n\nSoftware supply chain security tooling\n\nDesign and implement integrations between application security tooling and developer workflows to minimize friction and maximize adoption.\n\nDesign and build automation to support application security processes including:\nOrchestrated automated security testing.\n\nVulnerability triage and prioritization workflows\n\nDeveloper feedback loops and ticketing system integrations\n\nException handling, risk acceptance, and policy waiver workflows\n\nSecurity metrics and pipeline telemetry\n\nIdentify and assess application security risks including vulnerable dependencies, insecure authentication patterns, data exposure risks, and insecure configuration.\n\nPerform and support threat modeling, architecture reviews, and secure design assessments for high-risk, or business critical applications.\n\nSupport the security review, onboarding, and ongoing risk management of third-party and SaaS applications.\n\nDevelop and maintain metrics, dashboards, and reporting to measure application security posture, testing coverage, and vulnerability remediation effectiveness.\n\nProvide application security subject matter expertise during security incidents, investigations, and post-incident remediation efforts.\n\nLead, mentor, and develop a team of application security engineers, fostering strong technical depth and career growth.\n\nPartner with engineering leadership to drive secure-by-design development practices and shared accountability for risk reduction.\n\nCommunicate application security risks, tradeoffs, and recommendations clearly to both technical and executive stakeholders.\n\nPromote a developer-friendly security culture focused on automation, guardrails, measurable risk reduction, and engineering velocity.\n\nStay current on emerging application threats, attack techniques, and defensive technologies, and apply this knowledge to continuously improve program effectiveness.\n\nEDUCATION \nRequired\nBachelor’s degree in information security, IT, risk management, related discipline, or equivalent experience\n\nPreferred\nProfessional certifications such as CISSP, CISM, or similar\n\nSKILLS AND EXPERIENCE\n10+ years of progressive experience in application security, product security, or software security engineering roles\n\nHands-on experience securing modern application ecosystems, including web applications, APIs, microservices, cloud-native workloads, container, and Kubernetes platforms\n\nDemonstrated success building, scaling, and operating enterprise-grade Application Security programs within large, complex organizations, preferably in hybrid environments (on-premises, multi-cloud, Kubernetes, and SaaS).\n\nExperience partnering with application, DevOps, and platform engineering teams to design and implement security controls that scale without impeding developer velocity.\n\nHands-on experience implementing and operationalizing enterprise application security tooling and integrating controls into CI/CD pipelines and developer workflows.\n\nTechnical Skills & Knowledge:\nSecure SDLC principles and DevSecOps integration patterns\n\nApplication security testing methodologies and tooling (SAST, DAST, SCA, API testing)\n\nContainer security concepts, including image hardening, vulnerability scanning, secure registries, and container lifecycle management.\n\nCloud-native application security concepts\n\nSoftware supply chain security principles\n\nSecurity automation and scripting (Python, PowerShell, or similar)\n\nCI/CD security integration patterns\n\nDemonstrated ability to lead, mentor, and develop high-performing application security or product security engineering teams.\n\nStrong program and project management capabilities, with a track record of delivering complex, cross-functional initiatives on time and within budget.\n\nExperience operating within global organizations and collaborating effectively across diverse geographies, cultures, and business units.\n\nProven ability to manage third-party vendors and security technology providers, including evaluation, onboarding, delivery oversight, and performance management.\n\nStrong interpersonal and collaboration skills, with comfort engaging regularly with senior leadership and key internal and external stakeholders.\n\nExcellent executive communication and presentation skills, with the ability to clearly articulate risk, strategy, and technical concepts to both technical and non-technical audiences.\n\nStrong ability to manage multiple concurrent priorities, exercise sound judgment, and effectively allocate time and resources in a fast-paced environment.\n\nProven ability to execute effectively amid ambiguity and incomplete information, applying risk-based decision-making.\n\nDemonstrated continuous learning mindset, staying current on emerging technologies, security threats, vulnerabilities, and attack vectors.\n\nPassion for innovation, automation, and driving continuous improvement in application security processes.\n\nPOSTING DISCLOSURE:\nSimpson Thacher will not sponsor applicants for work visas for this position.\nSalary Information\nNY Only: The estimated base salary range for this position is $190,000 to $220,000 at the time of posting.\nThe actual salary offered will depend on a variety of factors, including without limitation, the qualifications of the individual applicant for the position, years of relevant experience, level of education attained, certifications or other professional licenses held, and if applicable, the location in which the applicant lives and/or from which they will be performing the job. This role is exempt meaning it is not overtime pay eligible.\nSimpson Thacher will not sponsor applicants for work visas for this position.\nPrivacy Notice\nFor information about how Simpson Thacher & Bartlett LLP collects and processes your personal information, please refer to our Privacy Notice available at https://www.stblaw.com/other/privacy-notice.\nSimpson Thacher & Bartlett is committed to a collegial work environment in which all individuals are treated with respect and dignity. The Firm prohibits discrimination or harassment based upon race, color, religion, gender, gender identity or expression, age, national origin, citizenship status, disability, marital or partnership status, sexual orientation, veteran’s status or any other legally protected status. This Policy pertains to every aspect of an individual’s relationship with the Firm, including but not limited to recruitment, hiring, compensation, benefits, training and development, promotion, transfer, discipline, termination, and all other privileges, terms and conditions of employment.\n#LI-Hybrid","description_format":"text","description_chars":8507,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Continuous learning"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Cybersecurity","Financial Services","Professional Services"],"lifecycle":[{"event":"open","at":"2026-09-29T09:22:48Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 82 · green card filings: 5","filings_12m":82,"filings_prev_12m":71,"green_card_filings_12m":5,"median_offered_wage_usd":268822,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":8,"band":"cold","label":"Long shot","p_open":1,"p_active":0.275,"p_room":0.28,"age_days":134,"expected_fill_days":24,"reasons":["conf:1","stale_co","velocity","win:tail","crowd:"],"computed_at":"2026-10-15T05:46:00Z"},"pay":{"stated_usd_annual":220000,"is_top_pay":true},"html_url":"https://alion.io/job/simpson-thacher-bartlett-llp-senior-manager-application-security","json_url":"https://alion.io/job/simpson-thacher-bartlett-llp-senior-manager-application-security.json","meta":{"generated_at":"2026-10-15T14:31:34Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":22230,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1842699},"rest":"https://alion.io/mcp/rest/get_company?id=1842699"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsimpson-thacher-bartlett-llp-senior-manager-application-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsimpson-thacher-bartlett-llp-senior-manager-application-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsimpson-thacher-bartlett-llp-senior-manager-application-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/simpson-thacher-bartlett-llp-senior-manager-application-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsimpson-thacher-bartlett-llp-senior-manager-application-security"}]}