Senior Application Security Engineer

Help secure Arch Re applications and supporting operations by shaping and strengthening the application security SDLC.

Responsibilities

• Use application development, deployment, and security experience to guide Application Security strategy and secure the software development lifecycle (SDLC)
• Configure and improve AppSec tooling and integrations, including SAST configuration, ignore lists, dashboards, and other controls to maintain useful coverage without excessive noise
• Lead API, Container, and Application Security testing, including DAST and other security validation capabilities, to improve security coverage and support timely remediation
• Develop strategies to secure current and emerging technologies (containers, serverless, API, AI/ML)
• Embed AI-specific security checks into SDLC reviews and code analysis, including input/output handling, AI-exposed APIs, prompt and response guardrails, and abuse or data-exfiltration paths
• Provide hands-on engineering support for security incidents, threat events, vulnerability management, and control improvements to strengthen enterprise application security posture
• Collect and report metrics from Application Security solutions and processes to deliver insights on security coverage, risk reduction, and program maturity
• Create and maintain technical standards, operational procedures, and documentation for Application Security services using guidance from NIST, OWASP, and SANS
• Deliver technical training to development and cloud engineering teams on secure development practices for API, container security, and vulnerability remediation
• Implement, optimize, and operationalize Application Security solutions to improve risk visibility, security coverage, and developer adoption
• Drive automation and security capabilities that improve developer experience, streamline security processes, and align Application Security solutions with technology and business goals
• Stay current on emerging Application Security trends, technologies, attack techniques, and best practices to continuously enhance Arch Re’s security posture

Requirements

• Undergraduate degree in a related field or equivalent combination of training and experience
• 5+ years of experience in cybersecurity with significant hands-on experience in application security
• Experience supporting or leading security reviews for AI-native products, internal agents, or AI-assisted engineering workflows
• Experience performing threat modeling and secure architecture reviews
• Strong experience deploying and operating DAST tools, including team onboarding, authentication setup, and CI/CD integration
• Experience with other well-known application security tools such as SAST and SCA
• Experience with cloud-native Azure and AWS Cloud Platforms
• Strong knowledge of application development, build, and deployment processes (development, IDEs, repositories, branching, pipelines, cloud, containers, serverless, etc.)
• Familiarity with industry standards such as NIST, OWASP, and MITRE
• Relevant certifications in application development, security, application security, DevSecOps, or cloud are a plus
• Experience developing security standards, assessment methodologies, and security review processes

Technologies

• CI/CD
• SAST
• DAST
• SCA
• Azure
• AWS Cloud Platforms
• containers
• serverless
• API
• AI/ML
• SSDLC
• IDE
• repositories
• branching
• pipelines
• prompt and response guardrails
• NIST
• OWASP
• SANS
• MITRE

Benefits

• Multiple medical plans plus dental, vision and prescription drug coverage
• Competitive 401k with generous matching
• PTO beginning at 20 days per year
• Up to 12 paid company holidays per year plus 2 paid days of Volunteer Time Offer
• Basic Life and AD&D Insurance as well as Short and Long-Term Disability
• Paid Parental Leave of up to 10 weeks
• Student Loan Assistance and Tuition Reimbursement
• Backup Child and Elder Care

Position Summary

• The Application Security team secures Arch Re applications and supporting operations through effective solutions, processes, and controls
• Ensure the right security guardrails are in place to identify risks early and support continuous, secure delivery of applications
• Apply expertise in CI/CD, secure software development, and application security best practices to enhance the developer experience and delivery of security services to end users
• Support secure-by-design standards, threat modeling, and continuous improvement to strengthen application security across the organization

Location and Compensation

• Location: Farmington, CT (onsite)
• Base salary range: USD 127,000 - 172,000 per year
• Total individual compensation (base salary, short & long-term incentives) will consider geographic location, scope and responsibilities, qualifications, talent availability and specialization, and business needs
• The pay range may be modified in the future