Application Security Engineer

State Street

Confirmed live yesterday High trust

Quick summary

Work type
On-site
Location
Quincy, MAToronto, Ontario, CanadaAustin, TXAtlanta, GA
Employment
Full-time
Posted
91 days ago
Freshness
Confirmed live yesterday

Market check

Salary context

How this pay compares to similar roles

Similar $180k
$130k $226k
below market most similar roles pay here above market

This listing doesn't post a salary. Most similar roles pay $145,000–$215,784.

Based on 240 similar postings.

Employer

About State Street

State Street Corporation is one of the world''s largest custodian banks and asset managers, providing investment servicing, investment management, and investment research to institutional investors. Industry: Financial Services & Asset Custody

State Street currently has 351 open roles on FindRole.

Listed pay typically runs $115,000–$195,944 across 199 roles with salary data.

Most-posted roles

View all roles at State Street

At a glance

TL;DR · Application Security Engineer

The Application Security Engineer - ADR joins the Cyber Security Architecture & Engineering team to design, implement, and support Application Detection and Response capabilities. This role focuses on providing visibility into application-layer threats and vulnerabilities across the enterprise application portfolio. You will build ADR strategies, integrate runtime security monitoring into DevSecOps programs, and lead the deployment of platforms to detect anomalous behaviors. Key responsibilities include developing detection logic, triaging security findings, and collaborating with engineering teams to remediate risks. Required technical skills include experience with Java, .NET, Python, Node.js, Azure, and AWS. You must possess expertise in SAST, DAST, SCA, API Security, and Container Security. Additionally, proficiency with Ansible, Terraform, Kubernetes, and Infrastructure as Code is essential for managing these complex security workflows.

What you'll do

  • Define and build the organization's Application Detection and Response (ADR) strategy.
  • Lead the deployment, onboarding, and operational support of ADR platforms across enterprise applications.
  • Monitor, analyze, and investigate application-layer security events and anomalous behaviors.
  • Develop use cases, detection logic, alerting mechanisms, and response workflows for application threats.
  • Collaborate with application teams to triage, prioritize, and remediate security findings and attack indicators.
  • Integrate ADR platforms with existing incident response processes and security tooling.
  • Deliver security reporting, dashboards, and metrics regarding application threats and remediation activities.
  • Maintain ADR, AppSec, and DevSecOps documentation, standards, and operational procedures.

What we're looking for

  • Bachelor’s degree in information technology, computer science, or a related field.
  • 6 years of relevant experience in information technology or a related field.
  • Proven expertise in Application Security (AppSec), Application Detection and Response (ADR), and DevSecOps.
  • Experience in software development and secure software development lifecycle (SDLC) practices.
  • Experience with application security tooling, modern CI/CD, and DevSecOps best practices.
  • Experience with cloud technologies including Azure and AWS.
  • Experience with automation and orchestration technologies such as Ansible, Terraform, Kubernetes, and Infrastructure as Code (IaC).
  • Current information security certifications such as CISSP, GCIH, GWAPT, or Security+ (preferred).

More like this

Similar roles

Application Security Engineer

State Street

Quincy, MA +4 60 days ago
DevSecOps AppSec CI/CD SAST DAST SCA Python Java .Net Node.js AWS Azure Kubernetes Terraform Ansible Infrastructure as Code Agile API Security Container Security SSDLC
6+ yrs exp

Security Engineer, Application Security

Blue Cross Blue Shield Association (BCBSA)

Chicago +1 14 days ago $118,500–$171,825
Application Security DevSecOps SAST DAST SCA Threat Modeling Infrastructure as Code Python Java JavaScript TypeScript Node.js C# Go SQL Bash AWS Azure Kubernetes OpenShift Docker Terraform Bicep Helm GitHub Actions Jenkins Azure DevOps Burp Suite OWASP ZAP Checkmarx Veracode Fortify SonarQube Snyk Prisma Cloud Wiz Tenable Aqua Security Trivy Postman SoapUI HIPAA HITRUST NIST Cybersecurity Framework FedRAMP FISMA FIPS OWASP Top 10 OWASP API Security Top 10 OWASP ASVS
5+ yrs exp Hybrid

Application Security Engineer

Booz Allen Hamilton

Annapolis Junction, MD +1 39 days ago $69,400–$158,000
SAST DAST SCA DevSecOps Secure SDLC Container Security Cloud Security Vulnerability Management OWASP SAMM BSIMM NIST SSDF NIST CSF ISO 27001 MITRE ATT&CK ISO/IEC 42001 IEC 62443
2+ yrs exp

Application Security Engineer

Booz Allen Hamilton

Washington, DC 14 days ago $62,000–$141,000
SAST DAST Threat Modeling Burp Suite Veracode Java Python .NET C# Linux UNIX OWASP NIST 800-53 FIPS FedRAMP IAST Eclipse JDeveloper
6+ yrs exp

Application Security Engineer

State Street

Quincy, MA 21 days ago $90,000–$157,500
DevSecOps AppSec CI/CD SAST SCA DAST Container Security Java .Net Python Node.js AWS Azure Terraform Kubernetes Ansible Infrastructure as Code Agile SSDLC Cloud Security System Hardening
6+ yrs exp

Software Supply Chain Security Engineer

State Street

Quincy, MA +4 54 days ago
AppSec DevSecOps Software Supply Chain Security CI/CD Java .Net Python Node.js AWS Azure Kubernetes Terraform Ansible JFrog Artifactory Maven Central PyPI SLSA Infrastructure as Code SSDLC
6+ yrs exp