Senior Application Security Engineer
About the role
At Wilson Elser, we are redefining what it means to work at a national law firm. With more than 1,400 attorneys across 46 offices nationwide, we are recognized among the top 100 law firms by The American Lawyer and ranked #30 in the National Law Journal’s survey of the nation’s largest law firms.
Our continued success is built on a culture of collaboration, innovation, client service, and mutual respect. We are committed to fostering an environment where employees are empowered to grow their careers, contribute meaningfully, and thrive professionally.
The Position
We are seeking a Senior Product Security Engineer to build and lead our secure software development and DevSecOps program. This is a program-building role for someone who has stood up application security from the ground up and can set its direction as the Firm continues its move to Azure.
You will serve as the bridge between Information Security and Application Development, embedding security into the development lifecycle without slowing delivery. The work spans internally developed applications, CI/CD pipelines, integrations, low-code/no-code platforms, and Azure-hosted services, and includes carrying security practices from the Firm’s traditional Windows infrastructure into cloud-native Azure patterns.
The role reports to Information Security with a strong dotted-line partnership into Application Development and Engineering leadership.
Key Responsibilities
Application Security & Secure Development Lifecycle (SDL)
- Build, lead, and mature the SSDLC program, including its roadmap, standards, and success measures
- Prioritize preventive controls designed into the build process (“baked in, not sprayed on”), using testing to validate secure design rather than replace it
- Perform application security reviews, threat modeling, secure architecture assessments, and source code review
- Establish secure coding standards, policies, and “paved road” patterns for common technologies and frameworks
DevSecOps & CI/CD Security
- Integrate and optimize SAST, DAST, SCA, API scanning, and IaC scanning within Azure DevOps pipelines
- Own vulnerability ingestion, triage, prioritization, remediation tracking, and reporting
- Build dashboards and metrics covering application security posture and remediation SLAs
- Script integrations to normalize findings across multiple security tools
Security Tooling
- Administer and tune Snyk, SonarQube, Azure DevOps, PowerShell scanning tools, and additional AppSec tooling as needed
- Suppress false positives, write custom detection rules, and identify gaps in tooling coverage
- Manage security exceptions and remediation timelines with development teams
Cloud & Platform Security
- Partner with cloud and infrastructure teams to secure Azure-hosted applications and services
- Support security reviews across Azure PaaS, containers, Databricks, MongoDB, Data Lake environments, Azure Data Factory, and Power Platform
- Help secure low-code/no-code platforms and their governance processes
Developer Enablement
- Launch and run a Security Champions program within engineering teams
- Deliver developer-focused training, workshops, and secure coding guidance
- Mentor developers and upskill Information Security staff on application security concepts and tooling
Qualifications
- 5+ years in Application Security, Product Security, DevSecOps, or Software Engineering
- Demonstrated experience building an application security or DevSecOps program from the ground up
- Experience leading or mentoring technical staff, formally or informally
- Hands-on experience securing Azure environments and Azure DevOps pipelines, and integrating security tooling into CI/CD
- Experience with Microsoft/Windows environments and .NET application stacks
- Strong grounding in secure coding principles, OWASP Top 10, secure SDLC, threat modeling, and vulnerability management
- Working experience with several of: Azure DevOps, Azure cloud services, Snyk, SonarQube, containers/Kubernetes, PowerShell, Python, .NET, JavaScript, React, PHP
- Ability to separate meaningful risk from low-value scanner findings
- Strong scripting and automation skills, with excellent communication and documentation
Preferred Qualifications
- Prior experience as a software developer or DevOps engineer
- Hands-on administration of Snyk and SonarQube
- Experience bridging on-premises infrastructure to Azure, including container and cloud-native application security
- Familiarity with low-code/no-code platform security and with OWASP ASVS, Azure Security Benchmark, or CIS Benchmarks
- Experience building Security Champion programs and presenting to both engineers and leadership
- Certifications such as CSSLP, OSWE, GWAPT, or Azure/Kubernetes security credentials
Leadership presence, with the ability to set direction and influence without direct authority. Pragmatic, collaborative, and enablement-focused rather than friction-creating, with the judgment to balance security requirements against development velocity. Strong ownership mentality, comfortable learning new technologies and operating independently.
Success Metrics (First 6-12 months)
- Program roadmap defined and agreed with Information Security and engineering leadership
- Security tooling integrated consistently across pipelines, with vulnerability management workflows and dashboards operational
- Security Champions program launched and development teams actively engaging with security processes
- Secure coding standards and reusable templates established
- Measurable reduction in unresolved high-risk findings
Wilson Elser offers a competitive salary and benefits package designed to support our attorneys both professionally and personally.
A variety of factors are considered in making compensation decisions, including but not limited to experience, education, licensure and/or certifications, geographic location, market demands, other business and organizational needs, and other factors permitted by law. Final salary wages offered may be outside of this range based on other reasons and individual circumstances. This position is considered full-time and therefore qualifies for benefits including 401(k) retirement savings plan, medical, dental, vision, disability, and life insurance. Details of participation in these benefit plans will be provided if an employee receives an offer of employment.
Why Should You Apply?
- Benefits: Outstanding benefits package, including 401k match and generous PTO plan
- Career Growth: Ample opportunities for professional development and advancement
- Employee Perks: Access to corporate discount plans and other benefits
Wilson Elser welcomes submissions of candidates for our open positions exclusively from recruitment agencies with an active, signed fee agreement who have been granted access to a position through our dedicated Recruitment Agency Portal. We are unable to consider submissions from recruitment agencies without a current (dated as of 7/1/2024) agreement in place. We appreciate your understanding. For collaboration inquiries or to establish an agreement, please contact us at [email protected].
Wilson Elser is committed to a collegial work environment in which all individuals are treated with respect and dignity. It is the Firm's policy that employment will be based on merit, qualifications, and competence. Further, employment decisions will be made without regard to an applicants race, color, age, sex, religion, creed, national origin, ancestry, citizenship, marital status, sexual orientation or preference, gender identity, physical or mental disability, status as a victim of domestic violence, sex offenses, or stalking, past or present service in the uniformed services or application or obligation to serve in the uniformed services, or any other characteristic protected by law.
Wilson Elser endeavors to make the Wilson Elser website accessible to any and all users. You may review our Accessibility Policy here.
California Residents may review our CCPA notice for applicants and employees here.
Wilson Elser participates in the federal E-Verify program. With respect to all new hires, we provide the Social Security Administration (SSA) and, if necessary, the Department of Homeland Security (DHS) with information from each new employee’s Form I-9 to confirm work authorization.
Please review the official posters for detailed information regarding your rights and protections
-
Download the E-Verify Participation Poster (English & Spanish)
-
Download the Right to Work Poster (English & Spanish)