Lead Application Security Engineer

• Application security sits at the center of how CAIS earns and keeps the trust of the advisors and asset managers who rely on our platform. As our lead for application security, you will own how we protect the applications and services we build and embedding security into the heart of how we design, write, and ship software
• You will define and drive our approach to secure development: setting threat modeling strategy, owning security architecture and secure code reviews, and designing the controls that live inside our SDLC. Just as importantly, you will use automation and AI to scale that work, turning security from a manual checkpoint into something engineers experience as fast, clear, and genuinely useful
• Own security elements of the software development lifecycle, designing and implementing automated controls within CI/CD, including SAST, DAST, dependency and container security scanning
• Conduct security architecture and design reviews across product and platform areas, surfacing risk early and providing clear, actionable remediation paths
• Drive CAIS’s threat modeling strategy, establishing it as a repeatable practice across teams rather than a one-off exercise
• Triage, validate, and prioritize findings, coordinating remediation through to resolution with clear ownership and follow-through
• Liaise with key vendors on penetration testing, vulnerability scanning, and threat modeling, translating external findings into prioritized action
• Partner with engineers and product owners to embed security pragmatically into design, development, and release, supporting teams without becoming a blocker
• Provide secure coding guidance and clear documentation that helps teams understand risk and apply secure development practices independently
• Level up CAIS’s security capability across the tech stack, experimenting with new tooling, automation, and AI-assisted workflows as the practice grows

Benefits

• Healthcare & wellness: We offer highly subsidized medical, dental, vision plan options, and monthly reimbursements to support your lifestyle outside of work
• Coverage Waiver Allowance: Have benefits through another source? Receive a monthly allowance for waiving coverage
• Voluntary benefits: Enjoy discounted pricing on virtual marketplace retail benefits, pet insurance, legal, identity theft, critical illness, hospital coverage, and additional life and AD&D insurance
• Paid parental leave: New parents receive up to 16 weeks of fully paid leave
• Flexible PTO: Take the time you need in coordination with your team and manager. Plus, enjoy nine paid holidays throughout the year
• 401(k) matching: Participate in a comprehensive 401(k) plan with a 4% match
• Free Food: Take advantage of our in-office lunch program and a fully stocked kitchen
• Team events: Join our monthly happy hours, team building activities, and other events to ensure we stay connected

• We are looking for a hands-on technical leader who is as comfortable reading production code as setting strategy.
• You see a growing security practice not as a constraint to enforce but as a capability to build, one that helps us ship reliable products, grow as engineers, and have some fun along the way
• You are someone who enjoys partnering with engineers and product owners; you are eager to experiment with new technologies to raise our security bar across the stack, and you are easy to do business with
• Experience in application or product security teams. A software engineering background is
• A builder’s mindset, you are energized by growing an application security practice from an early stage, eager to experiment and collaborative along the way
• Hands-on experience with security tooling across the SDLC, such as SAST, DAST, and dependency or container scanning (specific products are not important)
• Demonstrated experience driving threat modeling and leading security architecture and design reviews
• Ability to read and reason about production code and hold your own with senior engineers, with working knowledge of Java/Kotlin and JavaScript/TypeScript (React)
• Proven ability to lead engineering and security teams in adopting AI tools and automated workflows when it comes to security as part of the SDLC
• Solid AWS security experience, including securing cloud-native, containerized environments (e.g. EKS)
• A confident, collaborative communicator who partners effectively with engineers and product owners and explains risk clearly to both technical and non-technical audiences