Application Security Engineer

Job Description SummaryFor over forty years, HarbourVest has been home to a committed team of professionals with an entrepreneurial spirit and a desire to deliver impactful solutions to our clients and investing partners. As our global firm grows, we continue to add individuals who seek a collaborative, open-door culture that values diversity and innovative thinking.In our collegial environment that’s marked by low turnover and high energy, you’ll be inspired to grow and thrive. Here, you will be encouraged to build on your strengths and acquire new skills and experiences.We are committed to fostering an environment of inclusion that promotes mutual respect among all employees. Understanding and valuing these differences optimizes the potential of both the individual and the firm.HarbourVest is an equal opportunity employer.This position will be a hybrid work arrangement. You will receive 18 remote workdays per quarter to use at your discretion, subject to manager approval. For example, you may choose to work in the office 4 days per week and take one remote day weekly (typically 13 weeks per quarter), leaving 5 additional remote days to be used as needed.As a key member of the Security Engineering team, this person will help lead HarbourVest’s Application Security program. The Application Security Engineer (ASE) will serve in a multi-functional role, advising development teams on secure coding and accepted industry procedures. The ASE is responsible for leading SDLC initiatives that include secure code reviews, architecture assessments, and application scanning methods. They will provide end-to-end leadership for application security, working closely within platform teams to advocate for and enhance a strong program focused on application security. In this role, they will help uphold and continuously improve HarbourVest’s high security standards across infrastructure, applications, and operational processes.The ideal candidate is someone who is:Dedicated to protecting sensitive financial data, client information, and critical business systemsSkilled in navigating regulated financial services settingsAble to assess and prioritize security concerns by considering their effect on business and financial outcomesA collaborative partner to engineering, risk, compliance, and audit teamsProactive, diligent, and calm when responding to security incidentsWhat you will do:Identify risks and areas of exposure in applications, SDLC processes, and architectureDefine guardrails, standards, and secure usage patterns for agentic AI–based coding tools, enabling engineering teams to adopt them safely while managing data exposure, code quality, and security riskPerform secure build reviews, threat modeling, and application security testing (SAST, DAST, SCA)Identify, assess, and support remediation of vulnerabilities in web applications and APIsPartner with engineering teams to promote secure coding standards utilizing CI/CD pipelines and DevSecOps practicesSupport audits, regulatory exams, penetration tests, and security incident responseSecure and continuously monitor third-party SaaS applications using SSPM tools, ensuring configurations, access controls, and integrations meet HarbourVest security standardsEstablish metrics and reporting to track coverage and effectiveness of security processesEnable developers through secure coding guidance, training, and toolingAnd other responsibilities as required!What you bring:Solid understanding of application security principles and OWASP Top 10 risksExperience securing web applications, APIs, and microservices in financial environmentsHands-on experience with AI-assisted coding tools such as Cursor, GitHub Copilot, and ChatGPT Codex, with an understanding of their security implications in enterprise software developmentProficiency reviewing code in at least one common language (Java, Python, C#, or JavaScript)Familiarity with cloud platforms, containers, IaaC, and modern DevSecOps toolingAbility to clearly communicate technical risk to both technical and non-technical collaborators​Education Preferred:Bachelor’s degree or equivalent experience in Computer Science, Information Security, or a related fieldSecurity certifications such as CISSP, CSSLP, OSCP, GWAPT, or similar are a plusExperience:3-5 years of experience in application security or secure software developmentExperience working in controlled sectors such as finance, banking, or fintechExposure to compliance frameworks (e.g., SOC 2, SOX, PCI DSS, GDPR)#LI-HybridBase Salary Range:$145,000.00 - $155,000.00This USD base salary range represents only one component of total compensation for this role and is provided in accordance with local requirements. This role is eligible for a discretionary annual bonus, which is determined based on individual and overall firm performance. In addition to salary and bonus, total compensation may include eligibility for long-term reward programs and a comprehensive total rewards package that may include retirement, health, insurance, paid time off, and wellness programs. Our total rewards offerings are influenced by several business factors, and eligibility for certain components will vary by position and geography. Please note the posted ranges do not apply outside the U.S. and should not be converted to other currencies as a proxy for compensation in other countries.SummaryLocation: BostonType: Full time