Senior Application Security Engineer

The role

Build and lead the secure software development and DevSecOps program. Bridge Information Security and Application Development, embedding security into the development lifecycle as the Firm moves to Azure.

What you will do

• Build, lead, and mature the SSDLC program, including roadmap, standards, and success measures
• Perform application security reviews, threat modeling, secure architecture assessments, and source code review
• Integrate and optimize SAST, DAST, SCA, API scanning, and IaC scanning within Azure DevOps pipelines
• Own vulnerability triage, prioritization, remediation tracking, and reporting
• Build dashboards and metrics for application security posture and remediation SLAs
• Administer and tune Snyk, SonarQube, Azure DevOps, and other AppSec tooling
• Partner with cloud and infrastructure teams to secure Azure-hosted applications and services
• Launch and run a Security Champions program within engineering teams
• Deliver developer-focused training, workshops, and secure coding guidance
• Mentor developers and upskill Information Security staff

Required qualifications

• 5+ years in Application Security, Product Security, DevSecOps, or Software Engineering
• Demonstrated experience building an application security or DevSecOps program from the ground up
• Experience leading or mentoring technical staff, formally or informally
• Hands-on experience securing Azure environments and Azure DevOps pipelines
• Experience with Microsoft/Windows environments and .NET application stacks
• Strong grounding in secure coding, OWASP Top 10, secure SDLC, threat modeling, and vulnerability management
• Working experience with several of: Azure DevOps, Azure cloud services, Snyk, SonarQube, containers/Kubernetes, PowerShell, Python, .NET, JavaScript, React, PHP
• Ability to separate meaningful risk from low-value scanner findings
• Strong scripting and automation skills, with excellent communication and documentation

Nice to have

• Prior experience as a software developer or DevOps engineer
• Hands-on administration of Snyk and SonarQube
• Experience bridging on-premises infrastructure to Azure, including container and cloud-native application security
• Familiarity with low-code/no-code platform security and with OWASP ASVS, Azure Security Benchmark, or CIS Benchmarks
• Experience building Security Champion programs and presenting to engineers and leadership
• Certifications such as CSSLP, OSWE, GWAPT, or Azure/Kubernetes security credentials

Benefits

• Competitive salary and benefits package
• 401(k) retirement savings plan
• Medical, dental, and vision insurance
• Disability and life insurance
• 401k match and generous PTO plan
• Ample opportunities for professional development and advancement
• Access to corporate discount plans and other benefits

Before you apply

• Wilson Elser participates in the federal E-Verify program and confirms work authorization for new hires

About the company

Wilson Elser is a national law firm with more than 1,400 attorneys across 46 offices nationwide. It is recognized among the top 100 law firms by The American Lawyer.