Job Description
Description We are looking for an Application Security Engineer to join our growing Information Security team. In this role, you’ll collaborate with development, DevOps, and security teams to help build secure software at every stage of the SDLC. Your work will directly contribute to the protection of sensitive data, systems, and client trust across our digital landscape. Job Duties Partner with application delivery and DevOps teams to embed security into the SDLC and perform or facilitate the following functions: Conduct secure code reviews and perform SAST, DAST, and manual security assessments. Perform threat modeling and risk analysis for new and existing application architectures. Define, implement, and automate application security testing in CI/CD pipelines. Deploy and manage tools such as Snyk, Veracode, OWASP ZAP, Burp Suite, and Checkmarx. Provide actionable remediation guidance to developers and promote secure coding best practices. Deliver targeted security training sessions for development and engineering teams. Assist with incident response for application-related security events, including root cause analysis and follow-up improvements. Monitor and ensure adherence to industry frameworks and standards (e.g., OWASP, NIST, PCI-DSS). Define and maintain secure development policies and reference architectures. Stay ahead of emerging threats, zero-day vulnerabilities, and innovative security solutions. Research and recommend new tools and practices to strengthen our application security posture. Qualifications Education and Experience: Bachelor’s degree in computer science, Information Security, or a related field (or equivalent experience). 5-10 years of experience in application security, software development, or DevSecOps roles. Hands-on experience with application security tools such as Snyk, Veracode, OWASP ZAP, Burp Suite, Checkmarx or similar tools. Candidates must be authorized to work in the United States without employer sponsorship. Technical Skills Strong knowledge of web and mobile app vulnerabilities (e.g., OWASP Top Ten, CWE). Experience with at least one programming/scripting language (Python, Java, JavaScript, etc.). Proficiency in integrating security into CI/CD pipelines and DevOps workflows. Familiarity with cloud-native architectures and container security is a plus. Understanding of AI/ML security risks, including prompt injection, model misuse, data leakage, and secure API integrations. Soft Skills Strong analytical and problem-solving skills. Excellent verbal and written communication skills. Ability to explain technical risks to non-technical stakeholders. Preferred Qualifications (not Mandatory) Knowledge of containerization and orchestration platforms (Docker, Kubernetes). Experience securing AI/ML workloads or AI-enabled applications is a plus. Relevant security certifications (e.g., GIAC GCSA, GIAC GWAPT, GIAC WEB, CSSLP, CEH or similar) are a plus. What We Offer A collaborative, security-first culture Opportunities to lead security initiatives and influence engineering practices Ongoing professional development and certification support The base salary range for this position is $120,000 - $150,000 per year. This range reflects the minimum and maximum base salary we reasonably expect to pay for this role. In addition, this position may be eligible to participate in the relevant business unit’s incentive compensation plan, and other compensation programs as applicable. Eligible employees may participate in a 401(k) program with a generous profit-sharing contribution, medical, prescription dental, and vision coverage; life insurance; disability coverage; paid holidays; vacation; and sick time, subject to plan terms and Company policies. About Bessemer Trust Bessemer Trust is a family office, overseeing $250 billion in assets for 3,000 individuals and families of substantial wealth. Its more than 1,300 employees are singularly focused on private wealth management — disciplined investment management, sophisticated wealth planning, comprehensive family office services, and highly personalized client service. Established in 1907