Application Security Engineer

The Application Security Engineer role sits within D. E. Shaw & Co., L.P. Information Security team in the Systems group. This hands-on, individual-contributor position partners with developers to design secure solutions and to deliver automated, AI-enabled application security workflows and guardrails.

Role Overview

As an Application Security Engineer, you will design and operate agentic security workflows that continuously review code changes. You will also help strengthen the Secure Development Lifecycle (SDLC) by embedding secure coding practices with development teams and translating security findings into actionable guidance for technical stakeholders and, at times, non-technical audiences.

Key Responsibilities

• Design, build, and operate agentic security workflows that continuously review code changes, using existing analyzers and custom analysis to investigate findings and propose fixes.
• Build evaluations, feedback loops, and guardrails to measure false positives, missed vulnerabilities, and the safety of proposed fixes, using known test cases and expert review.
• Lead security and design reviews for new and existing software, collaborating with developers to identify vulnerabilities and recommend practical remediation.
• Support the secure use of agentic AI by assessing how developer agents and internal AI platforms handle identity, data access, and tool execution.
• Partner with development teams to strengthen secure coding practices and improve the Secure Development Lifecycle (SDLC).
• Represent Information Security to engineering teams by turning findings into clear, actionable guidance for technical stakeholders and, occasionally, non-technical stakeholders.

Requirements

• At least five years of experience in application security, product security, security engineering, or software engineering with a strong security focus.
• Bachelor’s degree (or higher) in computer science or a related technical discipline; advanced degrees in relevant areas such as cryptography are welcome.
• Advanced knowledge of web application security fundamentals, including web protocols, authentication and identity standards (e.g., OIDC), browser security behavior, and applied encryption basics.
• Fluency using AI in day-to-day engineering work, including experience building applications or agents with AI SDKs or an understanding of security risks in agentic applications.
• A demonstrated track record building security software (for example, product features, internal tools, custom scanners, or analysis capabilities) rather than only deploying or operating off-the-shelf tools.
• Hands-on experience finding and mitigating vulnerabilities in complex systems through secure design review, code review, or penetration testing.
• Familiarity with modern software development practices and workflows.
• Sound judgment and clear communication, including the ability to make security decisions independently and work effectively with developers.

Technologies

• OIDC
• AI SDKs

What You’ll Do Day-to-Day

• Lead security and design reviews for new and existing software, working directly with developers to identify vulnerabilities and recommend practical remediation.

Location and Compensation

• Location: New York, NY (onsite)
• Salary: USD 225,000 - 300,000 per year

Benefits

• Variable compensation in the form of a year-end bonus, guaranteed in the first year of hire
• Medical and prescription drug coverage
• 401(k) contribution matching
• Wellness reimbursement
• Family building benefits
• Charitable gift match program