Senior Application Security Engineer

At Wilson Elser , we are redefining what it means to work at a national law firm. With more than 1,400 attorneys across 46 offices nationwide, we are recognized among the top 100 law firms by The American Lawyer and ranked #30 in the National Law Journal’s survey of the nation’s largest law firms.

Our continued success is built on a culture of collaboration, innovation, client service, and mutual respect. We are committed to fostering an environment where employees are empowered to grow their careers, contribute meaningfully, and thrive professionally.

We are seeking a Senior Product Security Engineer to build and lead our secure software development and DevSecOps program. This is a program-building role for someone who has stood up application security from the ground up and can set its direction as the Firm continues its move to Azure.

You will serve as the bridge between Information Security and Application Development, embedding security into the development lifecycle without slowing delivery. The work spans internally developed applications, CI/CD pipelines, integrations, low-code/no-code platforms, and Azure-hosted services, and includes carrying security practices from the Firm’s traditional Windows infrastructure into cloud-native Azure patterns.

The role reports to Information Security with a strong dotted-line partnership into Application Development and Engineering leadership.

Build, lead, and mature the SSDLC program, including its roadmap, standards, and success measures

Prioritize preventive controls designed into the build process (“baked in, not sprayed on”), using testing to validate secure design rather than replace it

Perform application security reviews, threat modeling, secure architecture assessments, and source code review

Establish secure coding standards, policies, and “paved road” patterns for common technologies and frameworks

Integrate and optimize SAST, DAST, SCA, API scanning, and IaC scanning within Azure DevOps pipelines

Own vulnerability ingestion, triage, prioritization, remediation tracking, and reporting

Build dashboards and metrics covering application security posture and remediation SLAs

Script integrations to normalize findings across multiple security tools

Administer and tune Snyk, SonarQube, Azure DevOps, PowerShell scanning tools, and additional AppSec tooling as needed

Suppress false positives, write custom detection rules, and identify gaps in tooling coverage

Manage security exceptions and remediation timelines with development teams

Partner with cloud and infrastructure teams to secure Azure-hosted applications and services

Support security reviews across Azure PaaS, containers, Databricks, MongoDB, Data Lake environments, Azure Data Factory, and Power Platform

Help secure low-code/no-code platforms and their governance processes

Launch and run a Security Champions program within engineering teams

Deliver developer-focused training, workshops, and secure coding guidance

Mentor developers and upskill Information Security staff on application security concepts and tooling

5+ years in Application Security, Product Security, DevSecOps, or Software Engineering

Demonstrated experience building an application security or DevSecOps program from the ground up

Experience leading or mentoring technical staff, formally or informally

Hands-on experience securing Azure environments and Azure DevOps pipelines, and integrating security tooling into CI/CD

Experience with Microsoft/Windows environments and .NET application stacks

Strong grounding in secure coding principles, OWASP Top 10, secure SDLC, threat modeling, and vulnerability management

Working experience with several of: Azure DevOps, Azure cloud services, Snyk, SonarQube, containers/Kubernetes, PowerShell, Python, .NET, JavaScript, React, PHP

Ability to separate meaningful risk from low-value scanner findings

Strong scripting and automation skills, with excellent communication and documentation

Prior experience as a software developer or DevOps engineer

Hands-on administration of Snyk and SonarQube

Experience bridging on-premises infrastructure to Azure, including container and cloud-native application security

Familiarity with low-code/no-code platform security and with OWASP ASVS, Azure Security Benchmark, or CIS Benchmarks

Experience building Security Champion programs and presenting to both engineers and leadership

Certifications such as CSSLP, OSWE, GWAPT, or Azure/Kubernetes security credentials

Leadership presence, with the ability to set direction and influence without direct authority. Pragmatic, collaborative, and enablement-focused rather than friction-creating, with the judgment to balance security requirements against development velocity. Strong ownership mentality, comfortable learning new technologies and operating independently.

Success Metrics (First 6-12 months)

Program roadmap defined and agreed with Information Security and engineering leadership

Security tooling integrated consistently across pipelines, with vulnerability management workflows and dashboards operational

Security Champions program launched and development teams actively engaging with security processes

Secure coding standards and reusable templates established

Measurable reduction in unresolved high-risk findings

Wilson Elser offers a competitive salary and benefits package designed to support our attorneys both professionally and personally.

A variety of factors are considered in making compensation decisions, including but not limited to experience, education, licensure and/or certifications, geographic location, market demands, other business and organizational needs, and other factors permitted by law. Final salary wages offered may be outside of this range based on other reasons and individual circumstances. This position is considered full-time and therefore qualifies for benefits including 401(k) retirement savings plan, medical, dental, vision, disability, and life insurance. Details of participation in these benefit plans will be provided if an employee receives an offer of employment.

$150,000 — $180,000 USD

Why Should You Apply?

Outstanding benefits package, including 401k match and generous PTO plan

Career Growth: Ample opportunities for professional development and advancement

Employee Perks: Access to corporate discount plans and other benefits

Wilson Elser welcomes submissions of candidates for our open positions exclusively from recruitment agencies with an active, signed fee agreement who have been granted access to a position through our dedicated Recruitment Agency Portal. We are unable to consider submissions from recruitment agencies without a current (dated as of 7/1/2024) agreement in place. We appreciate your understanding. For collaboration inquiries or to establish an agreement, please contact us at talentacquisition@wilsonelser.com .

Wilson Elser is committed to a collegial work environment in which all individuals are treated with respect and dignity. It is the Firm's policy that employment will be based on merit, qualifications, and competence. Further, employment decisions will be made without regard to an applicants race, color, age, sex, religion, creed, national origin, ancestry, citizenship, marital status, sexual orientation or preference, gender identity, physical or mental disability, status as a victim of domestic violence, sex offenses, or stalking, past or present service in the uniformed services or application or obligation to serve in the uniformed services, or any other characteristic protected by law.

Wilson Elser endeavors to make the Wilson Elser website accessible to any and all users. You may review our Accessibility Policy here .

California Residents may review our CCPA notice for applicants and employees here .

Wilson Elser participates in the federal E-Verify program. With respect to all new hires, we provide the Social Security Administration (SSA) and, if necessary, the Department of Homeland Security (DHS) with information from each new employee’s Form I-9 to confirm work authorization.

Please review the official posters for detailed information regarding your rights and protections

Download the E-Verify Participation Poster (English & Spanish)

Download the Right to Work Poster (English & Spanish)

#ZR