Senior Application Security Engineer

Builds and matures the secure development and DevSecOps program at Wilson Elser, acting as the link between Information Security, where the role reports, and Application Development. The engineer runs the SSDLC program, carries out security reviews, threat modelling and code review, sets secure coding standards and reusable patterns, integrates and tunes SAST, DAST, SCA, API and IaC scanning in Azure DevOps with tools such as Snyk and SonarQube, tracks remediation through dashboards, supports security reviews of Azure services, Databricks, Power Platform and similar platforms, and runs a Security Champions program with developer training. The firm wants at least five years across application security, product security, DevSecOps or software development, practical pipeline security experience, and solid scripting. Based in New York.