# Senior Application Security Engineer at Wilson Elser > United States · Senior · Security · open. Source: https://alderhq.app/jobs/greenhouse%3Awilsonelser%3A5394020008 (read 2026-11-03). ## Facts (observed) - Company: [Wilson Elser](https://alderhq.app/companies/wilson-elser) - Location text: New York, New York; New York Downtown - Where it can be done from (inferred): United States (evidence: "Location: New York, New York; New York Downtown") - Posted: 2026-08-24 (71 days ago) - First seen by alder: 2026-11-02 · last verified: 2026-11-03 - Reposted: 0 times · edited: 0 times - Apply on the employer's site: https://job-boards.greenhouse.io/wilsonelser/jobs/5394020008 - Skills listed (inferred): JavaScript, React, Python, C#/.NET, PHP, MongoDB, Azure, Kubernetes, Docker ## Pay and sponsorship - Posted pay: $150k–$180k per year (from the listing's pay field) - Licensed UK sponsor: registered as "Wilson Elser Limited" (checked 2026-11-03, [register](https://www.gov.uk/government/publications/register-of-licensed-sponsors-workers)) ## Description (the employer's text) At Wilson Elser, we are redefining what it means to work at a national law firm. With more than 1,400 attorneys across 46 offices nationwide, we are recognized among the top 100 law firms by The American Lawyer and ranked #30 in the National Law Journal’s survey of the nation’s largest law firms. Our continued success is built on a culture of collaboration, innovation, client service, and mutual respect. We are committed to fostering an environment where employees are empowered to grow their careers, contribute meaningfully, and thrive professionally. ### The Position We are seeking a Senior Product Security Engineer to build and lead our secure software development and DevSecOps program. This is a program-building role for someone who has stood up application security from the ground up and can set its direction as the Firm continues its move to Azure. You will serve as the bridge between Information Security and Application Development, embedding security into the development lifecycle without slowing delivery. The work spans internally developed applications, CI/CD pipelines, integrations, low-code/no-code platforms, and Azure-hosted services, and includes carrying security practices from the Firm’s traditional Windows infrastructure into cloud-native Azure patterns. The role reports to Information Security with a strong dotted-line partnership into Application Development and Engineering leadership. ### Key Responsibilities ### Application Security & Secure Development Lifecycle (SDL) - Build, lead, and mature the SSDLC program, including its roadmap, standards, and success measures - Prioritize preventive controls designed into the build process (“baked in, not sprayed on”), using testing to validate secure design rather than replace it - Perform application security reviews, threat modeling, secure architecture assessments, and source code review - Establish secure coding standards, policies, and “paved road” patterns for common technologies and frameworks ### DevSecOps & CI/CD Security - Integrate and optimize SAST, DAST, SCA, API scanning, and IaC scanning within Azure DevOps pipelines - Own vulnerability ingestion, triage, prioritization, remediation tracking, and reporting - Build dashboards and metrics covering application security posture and remediation SLAs - Script integrations to normalize findings across multiple security tools ### Security Tooling - Administer and tune Snyk, SonarQube, Azure DevOps, PowerShell scanning tools, and additional AppSec tooling as needed - Suppress false positives, write custom detection rules, and identify gaps in tooling coverage - Manage security exceptions and remediation timelines with development teams ### Cloud & Platform Security - Partner with cloud and infrastructure teams to secure Azure-hosted applications and services - Support security reviews across Azure PaaS, containers, Databricks, MongoDB, Data Lake environments, Azure Data Factory, and Power Platform - Help secure low-code/no-code platforms and their governance processes ### Developer Enablement - Launch and run a Security Champions program within engineering teams - Deliver developer-focused training, workshops, and secure coding guidance - Mentor developers and upskill Information Security staff on application security concepts and tooling ### Qualifications - 5+ years in Application Security, Product Security, DevSecOps, or Software Engineering - Demonstrated experience building an application security or DevSecOps program from the ground up - Experience leading or mentoring technical staff, formally or informally - Hands-on experience securing Azure environments and Azure DevOps pipelines, and integrating security tooling into CI/CD - Experience with Microsoft/Windows environments and .NET application stacks - Strong grounding in secure coding principles, OWASP Top 10, secure SDLC, threat modeling, and vulnerability management - Working experience with several of: Azure DevOps, Azure cloud services, Snyk, SonarQube, containers/Kubernetes, PowerShell, Python, .NET, JavaScript, React, PHP - Ability to separate meaningful risk from low-value scanner findings --- Data: alder (https://alderhq.app). Cite https://alderhq.app/jobs/greenhouse%3Awilsonelser%3A5394020008 and the date you read it. Observed facts come from the employer's own listing; location reach, level, family and skills are inferences.