Application Security Engineer

OVERVIEW:

The D. E. Shaw group seeks application security engineers to join its Information Security team within the Systems group. This team is dedicated to advancing the firm's security posture across a fast-paced, large-scale IT environment, supporting investment activity and technology development. As AI transforms traditional security review, this hands-on individual-contributor role combines partnering with developers on secure design and building the automated, AI-enabled tools that shape how application security is done at the firm.

WHAT YOU'LL DO DAY-TO-DAY:

• Design, build, and operate agentic security workflows that continuously review code changes, using existing analyzers and custom analysis to investigate findings and propose fixes.
• Build evaluations, feedback loops, and guardrails that assess false positives, missed vulnerabilities, and the safety of proposed fixes, using known test cases and expert review.
• Lead security and design reviews for new and existing software, working directly with developers to identify vulnerabilities and recommend practical remediation.
• Help secure the firm's own use of agentic AI, assessing how developer agents and internal AI platforms handle identity, data access, and tool execution.
• Partner with development teams to embed secure coding practices and strengthen the Secure Development Lifecycle (SDLC).
• Represent Information Security to engineering teams, turning findings into clear, actionable guidance for technical and, occasionally, non-technical stakeholders.

WHAT WE’RE LOOKING FOR:

• At least five years of experience in application security, product security, security engineering, or software engineering with a solid security focus.
• A bachelor's degree or higher in computer science or a related technical discipline; advanced degrees in relevant specialties, such as cryptography, are welcome.
• Advanced knowledge of web application security fundamentals, including web protocols, authentication and identity standards (e.g., OIDC), browser security behavior, and applied encryption basics.
• Fluency using AI in day-to-day engineering work; experience building applications or agents with AI SDKs, or an understanding of security risks in agentic applications.
• A track record of building security software, such as product features, internal tools, custom scanners, or analysis capabilities, rather than only deploying or operating off-the-shelf tools.
• Hands-on experience finding and mitigating vulnerabilities in complex systems through secure design review, code review, or penetration testing.
• Familiarity with modern software development practices and workflows.
• Sound judgment and clear communication, with the ability to work effectively with developers and make security decisions independently.
• The expected annual base salary for this position is $225,000 to $300,000. Our compensation and benefits package includes variable compensation in the form of a year-end bonus, guaranteed in the first year of hire, and benefits including medical and prescription drug coverage, 401(k) contribution matching, wellness reimbursement, family building benefits, and a charitable gift match program.