Application Security Engineer - ADR

State Street is seeking an Application Security Engineer (ADR) to design, implement, and support Application Detection and Response capabilities. This position focuses on improving visibility into application-layer threats and vulnerabilities, leading ADR platform deployment, and strengthening detection and response workflows in partnership with engineering and security teams.

Key Responsibilities

• Define and build the organization’s Application Detection and Response (ADR) strategy, integrating runtime application security monitoring and threat detection into broader Application Security and DevSecOps programs.
• Collaborate with Engineering, Security Operations, Cloud Security, and Application Development teams to implement and operationalize ADR technologies and processes.
• Lead ADR platform deployment, onboarding, and ongoing operational support, ensuring integration with enterprise applications and security tooling.
• Monitor, analyze, and investigate application-layer security events, attack patterns, and anomalous behaviors identified through ADR solutions.
• Work with application teams to triage, prioritize, and remediate security findings, threats, and attack indicators detected in applications.
• Create ADR use cases, detection logic, alerting mechanisms, and response workflows to improve visibility and reduce response times.
• Integrate ADR platforms with incident response processes.
• Produce security reporting such as dashboards, metrics, and executive-level summaries covering application threats, attacks, and remediation progress.
• Develop and maintain ADR, AppSec, and DevSecOps documentation, standards, and operational procedures.
• Support internal and external audits by providing evidence and documentation aligned to application security monitoring and response capabilities.
• Contribute to continuous improvements in application monitoring, detection accuracy, response effectiveness, and security processes.
• Provide technical leadership for strategic projects through planning, implementation, and operationalization.

Required Qualifications

• Strong software development background using technologies such as Java, .NET, Python, Node.js, or similar platforms.
• Experience with Azure and AWS.
• Experience in Application Security, including SAST, DAST, SCA, API Security, Container Security, and Secure SDLC practices.
• Experience implementing or supporting ADR-related technologies such as Application Detection and Response (ADR), RASP, WAAP, and threat detection for applications.
• Strong understanding of attack techniques targeting web, mobile, cloud-native, and API-based applications, including OWASP Top 10, API security risks, and advanced threat scenarios.
• Ability to analyze application telemetry, logs, traces, and security events to identify malicious activity and investigate incidents.
• Highly desirable: current information security certifications such as CISSP, GCIH, GWAPT, or equivalent.
• Experience with automation and orchestration technologies including Ansible, Terraform, Kubernetes, and Infrastructure as Code (IaC) practices.
• Proven technical solutioning experience across Agile Development, DevOps, Cloud Engineering, Cloud Security, Application Security, Threat Detection, Incident Response, and Cybersecurity.
• Excellent verbal and written communication skills across technical, operational, and executive audiences.
• Ability to prioritize and manage multiple initiatives, operational responsibilities, incidents, and projects at the same time.

Technologies

• Java, .NET, Python, Node.js
• Azure, AWS
• SAST, DAST, SCA, API Security, Container Security, Secure SDLC
• Application Detection and Response (ADR), RASP, WAAP
• OWASP Top 10
• Ansible, Terraform, Kubernetes, Infrastructure as Code (IaC)
• Agile Development, DevOps, Cloud Engineering, Cloud Security
• Threat Detection, Incident Response

Education & Preferred Qualifications

• Bachelor’s degree in information technology (IT), computer science, or related field with 6 years of relevant experience.
• Experience in software development and secure software development lifecycle (SDLC).
• Experience with application security tooling operations within modern CI/CD and DevSecOps best practices.
• Experience partnering with the Dev community to influence adoption of application security best practices and tooling.
• Security+ or other cybersecurity certification.
• Experience with Agile and scrum practices.

Compensation & Location

• Location: Quincy, MA (onsite)
• Salary range: USD 120,000 - 202,500 per year

Benefits

• Retirement savings plan (401K) with company match
• Insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages
• Paid-time off including vacation, sick leave, short term disability, and family care responsibilities
• Access to the Employee Assistance Program
• Incentive compensation including eligibility for annual performance-based awards
• Eligibility for certain tax advantaged savings plans