Senior Application Security Engineer
Savvy Wealth3 months ago
Base Salary
$220k - $235k/yr
Responsibilities
- Own vulnerability management end to end across the product, codebases, and cloud infrastructure, from identification and triage through remediation closure.
- Build and operate the AppSec tooling pipeline for secrets scanning, SCA/dependency scanning, and SAST.
- Set and enforce codebase security hygiene and code review standards that account for AI-generated code.
- Partner with the internal AI team to create guardrails for AI-assisted development and integrations.
- Secure the SaaS stack by hardening configurations, reviewing OAuth grants and third-party integrations, and reducing misconfiguration risk.
- Help establish conditional access and identity controls, including SSO, phishing-resistant MFA, and managed-device posture.
- Define cloud and SaaS configuration baselines for the company’s infrastructure footprint.
- Improve detection and incident response readiness with high-signal detections and incident response participation.
- Work cross-functionally with Engineering, IT, and the internal AI team to communicate risks, remediation paths, and tradeoffs.
Requirements
- At least 5 years of hands-on security engineering experience, including significant application security or product security work.
- Strong software engineering fundamentals and the ability to read, write, and remediate code.
- Deep experience with secrets scanning, SCA/dependency scanning, SAST, and GitHub-centric security integration.
- Practical experience securing SaaS environments through OAuth and third-party application review, configuration hardening, and least-privilege access design.
- Working knowledge of cloud security across AWS and/or GCP and edge/CDN security with Cloudflare.
- Understanding of security risks in AI-assisted development and experience designing practical guardrails.
- Experience embedding security into engineering workflows and partnering with engineering teams as an enabler.
- Excellent communication, writing, independent-working, and risk-based prioritization skills.
- Preferred: experience building security programs at an early- to mid-stage company.
- Preferred: experience with SaaS security posture management, CSPM, or identity threat detection.
- Preferred: familiarity with securing LLM-based tooling, agentic workflows, or internal AI platforms.
- Preferred: detection engineering experience, including SIEM/MDR and high-signal alerting.
- Preferred: fintech or financial services experience.
- Preferred: offensive security experience such as penetration testing, bug bounty, or red teaming.
Benefits
- Unlimited PTO and paid company holidays
- Medical, dental, and vision plans
- 401(k), commuter, and HSA/FSA plans
- NYC office in Manhattan
- Lunch and snacks provided in the office
- Virtual mental health care, vision-related benefits, and health concierge services
- Employee assistance counseling for stress management, dependent care, nutrition, fitness, legal, and financial issues
- Competitive salary and equity package
Tech Stack
Categories
About Savvy Wealth
Savvy Wealth builds a digital-first wealth management platform and is the parent of Savvy Advisors, an SEC-registered investment advisor for independent financial advisors. Advisors join Savvy, bring their client book, and share assets-under-management revenue in exchange for a proprietary advisor/client portal, investment management, marketing, and back-office operations. Founded in 2021 and headquartered in New York, it uses AI to automate onboarding and planning workflows while leaving client advice to human advisors.