below marketmost similar roles pay hereabove market
This role pays less than
73%
of similar roles. Most pay
$147,875–$216,271
— the blue band above.
At the midpoint, this role pays about
$150k
versus about
$182k
for comparable roles.
Based on 240 similar postings.
Employer
About Arch Capital Group
Arch Capital Group is a global insurance and reinsurance company providing specialty insurance solutions across property, casualty, mortgage, and reinsurance markets. Industry: Insurance & Reinsurance
Arch Capital Group currently has
7 open roles
on FindRole.
Listed pay typically runs
$142,500–$173,500
across 6 roles with salary data.
The Senior Application Security Engineer joins the Application Security team to protect software development lifecycles through strategic controls and technical solutions. This role involves shaping security strategy, implementing new technologies, and maintaining technical controls to identify risks early. Key responsibilities include configuring SAST, SCA, and DAST tools, performing threat modeling, and conducting secure architecture reviews. The engineer will also embed AI-specific security checks into code analysis and provide hands-on support for security incidents. Required expertise includes CI/CD, secure software development, and cloud-native platforms like Azure and AWS. The position requires proficiency with industry standards from NIST, OWASP, and SANS to secure emerging technologies such as containers, serverless, and AI/ML. The work focuses on improving developer experience while ensuring continuous, secure delivery of applications.
Configure and improve AppSec tooling including SAST, DAST, and other security validation capabilities.
Embed AI-specific security checks into SSDLC reviews, including prompt guardrails and data-exfiltration path analysis.
Provide hands-on engineering support for security incidents, threat events, and vulnerability management.
Create and maintain technical standards and operational procedures based on NIST, OWASP, and SANS guidance.
Provide technical training to development and cloud engineering teams on secure coding and vulnerability remediation.
Develop strategies to secure emerging technologies such as containers, serverless, APIs, and AI/ML.
Gather and report metrics on security coverage, risk reduction, and program maturity.
Drive automation to streamline security processes and improve the developer experience.
What we're looking for
Undergraduate degree in a related field or an equivalent combination of training and experience.
5+ years of experience in cybersecurity with significant hands-on experience in application security.
Experience supporting or leading security reviews for AI-native products, internal agents, or AI-assisted engineering workflows.
Experience performing threat modeling and secure architecture reviews.
Strong experience deploying and operating DAST tools, including team onboarding, authentication setup, and CI/CD integration.
Experience with other application security tools such as SAST and SCA.
Experience with cloud-native Azure and AWS Cloud Platforms.
Strong knowledge of application development, build, and deployment processes including IDEs, repositories, branching, pipelines, containers, and serverless.
Familiarity with industry standards such as NIST, OWASP, and MITRE.
Relevant certifications in application development, security, application security, DevSecOps, or cloud (preferred).