Senior Application Security Engineer

The posting, as Wilson Elser - Business & Legal Professionals wrote it

At Wilson Elser , we are redefining what it means to work at a national law firm. With more than 1,400 attorneys across 46 offices nationwide, we are recognized among the top 100 law firms by The American Lawyer and ranked #30 in the National Law Journal’s survey of the nation’s largest law firms.

Our continued success is built on a culture of collaboration, innovation, client service, and mutual respect. We are committed to fostering an environment where employees are empowered to grow their careers, contribute meaningfully, and thrive professionally.

The Position

We are seeking a Senior Product Security Engineer to build and lead our secure software development and DevSecOps program. This is a program-building role for someone who has stood up application security from the ground up and can set its direction as the Firm continues its move to Azure.

You will serve as the bridge between Information Security and Application Development, embedding security into the development lifecycle without slowing delivery. The work spans internally developed applications, CI/CD pipelines, integrations, low-code/no-code platforms, and Azure-hosted services, and includes carrying security practices from the Firm’s traditional Windows infrastructure into cloud-native Azure patterns.

The role reports to Information Security with a strong dotted-line partnership into Application Development and Engineering leadership.

Key Responsibilities

Application Security & Secure Development Lifecycle (SDL)

• Build, lead, and mature the SSDLC program, including its roadmap, standards, and success measures
• Prioritize preventive controls designed into the build process (“baked in, not sprayed on”), using testing to validate secure design rather than replace it
• Perform application security reviews, threat modeling, secure architecture assessments, and source code review
• Establish secure coding standards, policies, and “paved road” patterns for common technologies and frameworks

DevSecOps & CI/CD Security

• Integrate and optimize SAST, DAST, SCA, API scanning, and IaC scanning within Azure DevOps pipelines
• Own vulnerability ingestion, triage, prioritization, remediation tracking, and reporting
• Build dashboards and metrics covering application security posture and remediation SLAs
• Script integrations to normalize findings across multiple security tools

Security Tooling

• Administer and tune Snyk, SonarQube, Azure DevOps, PowerShell scanning tools, and additional AppSec tooling as needed
• Suppress false positives, write custom detection rules, and identify gaps in tooling coverage
• Manage security exceptions and remediation timelines with development teams

Cloud & Platform Security

• Partner with cloud and infrastructure teams to secure Azure-hosted applications and services
• Support security reviews across Azure PaaS, containers, Databricks, MongoDB, Data Lake environments, Azure Data Factory, and Power Platform
• Help secure low-code/no

[…]
ccess to corporate discount plans and other benefits

Wilson Elser welcomes submissions of candidates for our open positions exclusively from recruitment agencies with an active, signed fee agreement who have been granted access to a position through our dedicated Recruitment Agency Portal. We are unable to consider submissions from recruitment agencies without a current (dated as of 7/1/2024) agreement in place. We appreciate your understanding. For collaboration inquiries or to establish an agreement, please contact us at talentacquisition@wilsonelser.com .

Wilson Elser is committed to a collegial work environment in which all individuals are treated with respect and dignity. It is the Firm's policy that employment will be based on merit, qualifications, and competence. Further, employment decisions will be made without regard to an applicants race, color, age, sex, religion, creed, national origin, ancestry, citizenship, marital status, sexual orientation or preference, gender identity, physical or mental disability, status as a victim of domestic violence, sex offenses, or stalking, past or present service in the uniformed services or application or obligation to serve in the uniformed services, or any other characteristic protected by law.

Wilson Elser endeavors to make the Wilson Elser website accessible to any and all users. You may review our Accessibility Policy here .

California Residents may review our CCPA notice for applicants and employees here .

Wilson Elser participates in the federal E-Verify program. With respect to all new hires, we provide the Social Security Administration (SSA) and, if necessary, the Department of Homeland Security (DHS) with information from each new employee’s Form I-9 to confirm work authorization.

Please review the official posters for detailed information regarding your rights and protections

Download the E-Verify Participation Poster (English & Spanish)

Download the Right to Work Poster (English & Spanish)

#ZR