Senior Application Security Engineer

About AlphaSense: AlphaSense is the world’s premier, hyper-growth market intelligence pioneer, B2B SaaS innovator, and AI-powered search platform on an absolute mission to remove uncertainty from institutional decision-making. Trusted by over 6,000 enterprise customers—including a majority of the S&P 500—AlphaSense unifies an expansive universe of public and private data sets, encompassing elite equity research, company filings, real-time event transcripts, expert calls, trade journals, and proprietary customer data. Enhanced by the milestone acquisition of Tegus, AlphaSense integrates cutting-edge semantic search engines with secure generative systems to help corporate professionals unearth mission-critical insights smoothly, confidently, and at high velocity.

Position Overview

We are seeking a highly sophisticated, hands-on Senior Application Security Engineer to join our core global Product Security team in a full-time remote capacity within the United States. Moving far beyond the role of a traditional compliance auditor or passive dashboard manager, you will operate as a primary code-writing security contributor at the intersection of high-velocity agile development and agentic AI. You will own the pull-request enforcement layers and deterministic security gates that validate code shipped concurrently by human developers and automated AI coding agents. This foundational role demands a seasoned full-stack engineer who reads code fluently across multiple software branches, understands Model Context Protocol (MCP) topologies, and treats application security as a collaborative engineering partnership designed to drive vulnerabilities down to zero.

Key Responsibilities

• Continuous Code & PR Enforcement: Operate, customize, and continuously tune our high-volume automated SAST, SCA, secrets-detection, and SBOM pipelines across all deployment repositories.
• AI-Authored Security Hardening: Design, implement, and secure deterministic testing gates that make AI-authored pull requests auditably equivalent to human-reviewed source code.
• Semantic Defect Remediation: Evaluate human- and agent-authored pull requests manually to capture abstract semantic violations and logic flaws that traditional static scanning engines miss.
• Agentic Infrastructure Governance: Establish, publish, and enforce robust AI-assisted development security policies, engineering prompt injection defenses, jailbreak resistance patterns, and audit logs.
• MCP Architecture Threat Modeling: Conduct deep-dive architectural threat modeling across newly engineered AI features, agent gateways, and Model Context Protocol (MCP) server connectors to deploy strict credential controls.
• Ecosystem Identity Registration: Partner alongside internal core harness engineering squads to establish agent scope declarations, verified identity registration hooks, and explicit audit-trail attributions.
• Incident Response & Forensics: Serve as the primary technical responder for application-layer security incidents and agentic behavior anomalies, orchestrating containment scripts and post-incident hardening.
• Developer Training Scaling: Pilot and scale secure coding training programs across distributed squads, embedding testable security acceptance criteria directly into the product requirement documentation templates.

Required Skills & Qualifications

• 6+ years of verified professional history running advanced software development, full-stack web application engineering, or product security architecture inside a cloud-native SaaS environment.
• Minimum of 4 years of dedicated history in a core Application Security or Product Security role (traditional compliance consulting or pure auditing backgrounds do not qualify).
• Deep, recent code authorship background, highlighting the ability to read pull requests fluently in at least two of the following languages: Python, TypeScript / JavaScript, Java / Kotlin, or Go.
• Practical, hands-on execution history building with, integrating, or securing agentic AI tools or Model Context Protocol (MCP) nodes (e.g., configuring Claude Code, Cursor, or custom agent gateway harnesses).
• Production-scale experience implementing and fine-tuning vulnerability scanning instrumentation, including Snyk, Semgrep, GitHub Advanced Security, Checkmarx, or Veracode.
• Strong deployment familiarity writing configuration definitions natively using Terraform, Helm charts, and Kubernetes manifests.
• Outstanding verbal and written communication mechanics, with an ability to author clear engineering runbooks, architectural policies, and constructive pull request feedback comments.
• Location Context: Full-time remote-first parameters open exclusively to qualified application security leads permanently based within the United States.

Preferred Strategic Indicators (Nice to Have)

• Direct open-source contribution history to security linters, automated SAST tools, agent harnesses, or Model Context Protocol frameworks.
• Hands-on expertise utilizing DAST engines and API security testing tools (such as Burp Suite, OWASP ZAP, or Akto) alongside container admission controllers.
• Deep underlying configuration security experience inside Amazon Web Services (AWS), covering IAM policies, KMS encryption, GuardDuty alerts, and Security Hub integrations.
• Familiarity with enterprise compliance parameters, including SOC 2 Type II, ISO 27001:2022, ISO 42001, and GDPR guidelines within regulated market models.
• Possession of highly regarded industry safety badging, including OSWE, OSCP, CSSLP, or CISSP certifications.

What We Offer

• Novel Scaled Scope Canvas: The exceptional professional runway to directly architect, code, and define the AI-augmented layered defense program protecting an industry-leading B2B market intelligence platform.
• An attractive, benchmarked annual base salary range calibrated transparently between $157,000 – $216,000 USD, tailored precisely to evaluate your technical experience.
• Profound work-from-home remote parameters offering high lifestyle flexibility, complete execution autonomy, and a competitive performance-based corporate bonus track.
• Access to valuable corporate equity options alongside a generous, top-tier comprehensive health insurance program and retirement benefits plan.
• A collaborative, high-agency engineering culture built around small senior teams, offering a direct, non-bureaucratic path toward Staff Engineer or Technical Lead rankings.