Application Security Engineer

The D. E. Shaw group seeks application security engineers to join its Information Security team within the Systems group. This team is dedicated to advancing the firm's security posture across a fast-paced, large-scale IT environment, supporting investment activity and technology development. As AI transforms traditional security review, this hands-on individual-contributor role combines partnering with developers on secure design and building the automated, AI-enabled tools that shape how application security is done at the firm.

What you’ll do day-to-day Design, build, and operate agentic security workflows that continuously review code changes, using existing analyzers and custom analysis to investigate findings and propose fixes. Build evaluations, feedback loops, and guardrails that assess false positives, missed vulnerabilities, and the safety of proposed fixes, using known test cases and expert review. Lead security and design reviews for new and existing software, working directly with developers to identify vulnerabilities and recommend practical remediation.

Help secure the firm's own use of agentic AI, assessing how developer agents and internal AI platforms handle identity, data access, and tool execution. Partner with development teams to embed secure coding practices and strengthen the Secure Development Lifecycle (SDLC). Represent Information Security to engineering teams, turning findings into clear, actionable guidance for technical and, occasionally, non-technical stakeholders.

What we’re looking for At least five years of experience in application security, product security, security engineering, or software engineering with a solid security focus. A bachelor's degree or higher in computer science or a related technical discipline; advanced degrees in relevant specialties, such as cryptography, are welcome. Advanced knowledge of web application security fundamentals, including web protocols, authentication and identity standards (e.g., OIDC), browser security behavior, and applied encryption basics.

Fluency using AI in day-to-day engineering work; experience building applications or agents with AI SDKs, or an understanding of security risks in agentic applications. A track record of building security software, such as product features, internal tools, custom scanners, or analysis capabilities, rather than only deploying or operating off-the-shelf tools. Hands-on experience finding and mitigating vulnerabilities in complex systems through secure design review, code review, or penetration testing.

Familiarity with modern software development practices and workflows. Sound judgment and clear communication, with the ability to work effectively with developers and make security decisions independently. The expected annual base salary for this position is $225,000 to $300,000. Our compensation and benefits package includes variable compensation in the form of a year-end bonus, guaranteed in the first year of hire, and benefits including medical and prescription drug coverage, 401(k) contribution matching, wellness reimbursement, family building benefits, and a charitable gift match program.