Application Security Engineer

3 weeks ago

New York, United States Capital Group Full time
"I can succeed as an Application Security Engineer at Capital Group"

As the Application Security ("AppSec") Engineer you are an individual contributor in the Capital Group (CG) AppSec team. The CG AppSec team is part of Information Security in CG's Information Technology Group. In the role you will be reviewing the architectures and performing threat models, code reviews, validating cloud configurations, and validating the DAST, SAST, and SCA findings for web applications. You will be doing code reviews (Java, TypeScript/JavaScript, Python, Terraform) and creating POCs for DAST tooling where required or collaborating with the penetration testers, as appropriate. The team members are geographically dispersed with varying experience levels. You will help the teams understand how to fix issues and provide best practices or appropriate compensating controls. In this role, you will be using threat modeling tools, static analysis tools, cloud configuration tools. If you are good at software security, this role is for you.

A typical day in the life of the AppSec engineer may look like the following:

  • You will be performing AppSec reviews including threat modeling, and code reviews
  • You will be meeting with the software development teams to understand a new application they are building and providing them with feedback on their architecture
  • You leverage SAST, DAST, SCA tools to create findings and translating them to severity of risks to perform this in Capital Group's technology environment
  • You will write clear, succinct and effective technical documentation summarizing your findings, risks, and recommendations
  • You will write automated proof-of-concepts, and automated security tests by authoring security testing tools where needed
  • You will collaborate with technology stakeholders and advise on risks for technology solutions such as SaaS services and how they integrate with CG's environment
  • You will communicate effectively and have an empathetic outlook towards development teams by authoring clear, actionable guidance on writing secure code
  • You will effectively present to development teams educating them on secure development.
"I am the person Capital Group is looking for."
  • You have a bachelor's degree in computer science, a related field, or equivalent experience (preferably 7+ years of experience)
  • You understand threat modeling, code reviews, network security, TCP/IP, DNS, TLS, HTTP, etc.
  • You have experience with technologies such as Threat modeler/Threat Dragon, Scoutsuite, Veracode, Checkmarx, Netsparker, DAST scanners like Burpsuite
  • You have the ability to automate tasks in Python, bash, Java, C/C#/C++, Rust, etc.
  • You have a strong understanding of attacks in AWS, Azure, OAuth
  • You have excellent communication skills (written, oral), with the ability to simplify and document complex technical details to both technical and non-technical audiences
  • You can learn quickly and have a track record of developing a deep understanding of systems and risks to the business
  • You can work independently and take the initiative to drive security initiatives forward
  • You can juggle multiple tasks and coordinate/delegate to achieve speedy resolutions to application security-related security incidents working with Security operations.


In addition to a highly competitive base salary, per plan guidelines, restrictions and vesting requirements, you also will be eligible for an individual annual performance bonus, plus Capital's annual profitability bonus plus a retirement plan where Capital contributes 15% of your eligible earnings.

You can learn more about our compensation and benefits here.

* Temporary positions in Canada and the United States are excluded from the above mentioned compensation and benefit plans.

We are an equal opportunity employer, which means we comply with all federal, state and local laws that prohibit discrimination when making all decisions about employment. As equal opportunity employers, our policies prohibit unlawful discrimination on the basis of race, religion, color, national origin, ancestry, sex (including gender and gender identity), pregnancy, childbirth and related medical conditions, age, physical or mental disability, medical condition, genetic information, marital status, sexual orientation, citizenship status, AIDS/HIV status, political activities or affiliations, military or veteran status, status as a victim of domestic violence, assault or stalking or any other characteristic protected by federal, state or local law.

  • Application Security Engineer

    1 month ago

    New York, United States Alloy Full time

    Alloy is where you belong! Alloy solves the identity risk problem for companies that offer financial products by enabling them to outpace fraud and confidently serve more people around the world. Banks and Fintechs turn to Alloy to take control of fraud, credit, and compliance risk, and grow with the clearest picture of their customers. Through our values:...

  • Application Security Engineer

    4 weeks ago

    New York, United States InterSources Full time

    Job Title: Senior Application Security Engineer Work Location: New York, NY Duration: 12 months contractPosition Summary: Hours: THIS POSITION WILL ALLOW 35.00 - HOURS PER WEEKMANDATORY SKILLS/EXPERIENCE 12 years of experience in application security, with a proven track record of conducting vulnerability assessments, penetration testing, and secure code...

  • Application Security Engineer

    2 weeks ago

    New York, United States Capital Group Full time

    ‘I can succeed as an Application Security Engineer at Capital Group‘As the Application Security (‘AppSec‘) Engineer you are an individual contributor in the Capital Group (CG) AppSec team. The CG AppSec team is part of Information Security in CG‘s Information Technology Group. In the role you will be reviewing the architectures and performing...

  • Senior Application Security Engineer

    3 weeks ago

    New York, United States Disability Solutions Full time

    ABOUT THE ROLEThe Senior Application Security Engineer is instrumental in ensuring Peloton's applications, services and systems are implemented and secured with industry standard processes. The candidate will help define and mature the application security program, security policy and standards and will coordinate with engineering and platform partners to...

  • Senior Application Security Engineer

    1 month ago

    New York, United States Tbwa ChiatDay Inc Full time

    Headway’s mission is a big one – to build a new mental health care system everyone can access. We’ve built technology that helps people find great therapists with the first software-enabled national network of providers accepting insurance.1 in 4 people in the US have a treatable mental health condition, but the majority of providers don’t accept...

  • Application Security Solutions Engineer

    1 day ago

    New York, New York, United States Amazon Full time

    We're a team of dedicated security professionals working to create a safe and secure environment for our customers. Our organization is responsible for creating and maintaining a high bar for security across all of Amazon's products and services. We're seeking a skilled Application Security Solutions Engineer to join our Application Security Automation team....

  • Application Security Engineer II

    3 weeks ago

    New York, United States Capital Group Full time

    “I can succeed as an Application Security Engineer at CG” As the Application Security (“AppSec”) Engineer you are an individual contributor in the Capital Group (CG) AppSec team. The CG AppSec team is part of Information Security in CG’s Information Technology Group. In the role you will be reviewing the architectures and performing threat...

  • Senior Web Application Engineer

    4 weeks ago

    New York, New York, United States Walrus Security, Inc Full time

    About Walrus Security, Inc.Walrus Security, Inc. is the industry leader in B2B payment verification, working with some of the most prominent names in venture capital and private equity.The B2B payments industry is projected to reach $1T+ in value, with digitization and faster settlement driving growth. However, this expansion also brings increased risk of...

  • Senior Application Security Engineer New

    2 months ago

    New York, United States Tbwa ChiatDay Inc Full time

    Headway’s mission is a big one – to build a new mental health care system everyone can access. We’ve built technology that helps people find great therapists with the first software-enabled national network of providers accepting insurance.1 in 4 people in the US have a treatable mental health condition, but the majority of providers don’t accept...

  • Cloud Security Engineer with UI Focus

    4 weeks ago

    New York, New York, United States Armis Security Full time

    Secure the Future of Cyber Exposure ManagementAt Armis Security, we're revolutionizing the way organizations protect their attack surface and manage cyber risk exposure in real-time. As a Senior Full Stack Engineer on our team, you'll have the opportunity to make a significant impact in an important field while maintaining a healthy work-life balance.About...

  • Secure AI Applications Engineer

    1 week ago

    New York, New York, United States Amazon Full time

    About UsAmazon is committed to being Earth's Best Employer. We prioritize ongoing training, learning experiences, and diverse perspectives to drive innovation and success. Our inclusive culture supports employee well-being and fosters collaboration and creativity.Job OverviewAs an AI Security Specialist on the AppSec AI team, you will contribute to securing...

  • Cloud Security Architect

    1 week ago

    New York, New York, United States Zip Security Full time

    Company OverviewAt Zip Security, we're revolutionizing enterprise cybersecurity by making it reasonable. Our goal is to reduce bloat by bundling and configuring opinionated security tooling, synchronizing everything from device management to application security under one central pane of glass.The RoleWe're seeking a Founding Backend Engineer to help build...

  • Application Security Specialist

    7 days ago

    New York, New York, United States Aloden, Inc. Full time

    Aloden, Inc.Information Security Position DescriptionNew York AreaWe are looking for an experienced Information Security Engineer 3 to enhance the security posture of our SaaS platform. This role requires a strong background in application security, vulnerability management, and SaaS security best practices.Job Summary:Develop and implement effective...

  • Enterprise Application Security Architect

    6 days ago

    New York, New York, United States A-1 Consulting Inc, Atlanta, GA Full time

    A-1 Consulting Inc, a leading technology firm in Atlanta, GA, is seeking an experienced Enterprise Application Security Architect to join our team. This role will be responsible for designing and implementing secure systems, networks, and applications.Estimated salary: $120,000 - $180,000 per year.Design and implement secure systems, networks, and...

  • Application Security Architect

    4 weeks ago

    New York, United States Futran Tech Solutions Pvt. Ltd. Full time

    Identify, educate and remediate vulnerabilities in code using SAST, DAST, Credential Scanning, and Container Scanning tools. Design, build and deploy automation to scale vulnerability discovery efforts. Experience with Vulnerability Management Experience with SAST and DAST remediation Experience with Container Scanning remediation Experience with...

  • Software Engineering Leader for Scalable Email Security Solutions

    4 weeks ago

    New York, New York, United States Abnormal Security Full time

    About the RoleAt Abnormal Security, we are seeking a highly experienced Senior Software Engineer to join our Inbound Email Products - Systems (IEPS) team. As a key member of this team, you will be responsible for designing and building critical components of our flagship Email Security product.

  • Chief Application Security Lead

    3 weeks ago

    New York, New York, United States Client Server Full time

    About the RoleWe are seeking a Chief Application Security Lead to head up our Product Engineering division and provide expertise on secure coding practices ensuring that security is built into the fabric of our product.Job DescriptionIn this role, you will collaborate with senior stakeholders to prioritise requests, plan the roadmap and ensure the team can...

  • Application Security Engineering Lead

    2 weeks ago

    New York, New York, United States Amazon Full time

    About the RoleWe are seeking an experienced Software Security Assessment Manager to join our Application Security Automation team. The successful candidate will be responsible for developing, curating, and improving application security detections to identify vulnerabilities at scale.Key ResponsibilitiesDevelop Secure Solutions: Develop, curate, and improve...

  • Application Security Specialist

    4 weeks ago

    New York, New York, United States Match Group Full time

    Secure the Future of Dating with Match GroupAbout Us:Match Group is a leading provider of dating products across the globe, connecting singles worldwide through various platforms including Tinder, Match, Hinge, and others. Our mission is to create a sense of belonging among our users.Salary Range:$120,000 - $180,000 per year based on experience, depending on...

  • High-Level Application Security Strategist

    4 weeks ago

    New York, New York, United States Uniswap Labs Full time

    About Uniswap LabsAt Uniswap Labs, we're dedicated to unlocking value through universal exchange. Our vision is a future where digital economies flourish, and markets are transparent, global, and equitable.SalaryThe estimated salary for this role is $264,000-$294,000 per year, based on industry standards and location.Job DescriptionWe're seeking a highly...