Who we are looking for

The Advanced Defensive – Application Security Engineers is a member of a small team tasked with securing the firm's most critical network environments and applications.

The Advance Defensive – Application Security Engineer is responsible for secure design, development, and testing of systems and the evaluation of system security throughout the system’s development life cycle. You must be ready to work collaboratively across the team, learning new skills and forging new procedures, relationships, and methods. Remote work options will be considered for highly skilled candidates.

What you will be responsible for

• Interpret architecture diagrams and controls to enhance the security of new and existing systems.
• Develop application and system cybersecurity designs to meet specific operational needs and environmental factors (e.g., access controls, automated applications, networked operations, high integrity and availability requirements, multilevel security/processing of multiple classification levels, and processing Sensitive Compartmented Information).
• Determine the impacts if vulnerabilities or exploited or a system is compromised.
• Determine the application teams’ lifecycle support requirements.
• Implement application cybersecurity policies using policy as code, automation, and documented and verified manual procedures.
• Implement automated measures to determine the effectiveness of system cybersecurity measures.
• Develop cybersecurity risk profiles for systems.
• Work with developers to create system prototypes using UAT and prototype models.
• Determine if hardware, operating systems, and software adequately addresses a system’s cybersecurity requirements.
• Design and ensure implementation of system backup and failover capabilities.
• Create system testing and validation procedures and documentation.
• Develop system security design documents.
• Develop system recovery and continuity plans.
• Test recovery and continuity plans.

​What we value

The following knowledge and experiences will help you succeed in this role:

• Minimum of 5 years of experience in full-stack application development across the entire application life cycle.
• Experience designing and deploying payment systems, classified systems, or other critical environments.
• Experience in embedding technical security policies, principles, and standards within applications and network segments.
• Experience developing automated testing to ensure systems are functioning properly or are secure.
• Experience advising development teams on various issues.
• Experience presenting to and advising executives.
• Knowledge of secure software development, deployment, and maintenance.
• Knowledge of agentic AI systems, and their use in system and application development.
• Knowledge of computer network protocols.
• Knowledge of system design tools and techniques.
• Knowledge of server administration and principles and practices.
• Knowledge of database systems.
• Knowledge of Identity Access Management principles including application and API authentication, OAuth2.0, and JWT tokens.
• Knowledge of encryption algorithms (e.g., RC4, AES, PQC)
• Knowledge of key management.
• Knowledge of secure system architecture principles and designs.
• Knowledge of secure software engineering principles and practices.
• Knowledge of enterprise information technology (IT) architecture principles, practices and reference models.
• Knowledge of systems engineering processes, principles and practices.
• Knowledge of cyber security threat actors TTPs, tradecraft, and noteworthy attacks.
• Knowledge of cybersecurity principles and practices, including defense in depth.
• Awareness of compliance, including aligning detection strategy with global financial regulations, ISO 27001, EU GDPR, PCI-DSS, EU DORA, SOX, NIST CSF, US OCC Part 30 Safety and Soundness Standards, and financial compliance frameworks.
• Knowledge of application and network segment security reviews and threat modeling, including code reviews and dynamic testing.
• Knowledge of managing and performing application security vulnerability management.
• Knowledge of implementing security controls into cloud environments.
• Knowledge of human error probabilities (HEPs) and performance shaping factors.

Education & Preferred qualifications

• Bachelor’s degree in computer science, information security, engineering, data science, mathematics, or another relevant field.
• Possess a Postgraduate degree in computer science, information security, engineering, data science, mathematics, or another relevant field.
• Experience working with information security teams such as fusion centers, security operations centers, vulnerability assessment, vulnerability threat management, security incident management, cyber “hunt,” and big data analysis.
• Experience working with law enforcement agencies and external audit organizations for investigations, audits, and similar activities.
• Self-starter, self-motivated, and able to work independently with little oversight while managing a large, globally distributed team.
• Highly polished presentation skills, with the ability to simply and convincingly present technical issues to non-technical audiences.
• Able to develop and operate within a set financial budget.

Desired Outcomes

Implement architecture and controls into new and existing systems to reduce vulnerabilities and prevent effective attacks against the system.

Salary Range:

$120,000 - $202,500 Annual

The range quoted above applies to the role in the primary location specified. If the candidate would ultimately work outside of the primary location above, the applicable range could differ.

Employees are eligible to participate in State Street’s comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages; paid-time off including vacation, sick leave, short term disability, and family care responsibilities; access to our Employee Assistance Program; incentive compensation including eligibility for annual performance-based awards (excluding certain sales roles subject to sales incentive plans); and, eligibility for certain tax advantaged savings plans.

For a full overview, visit https://hrportal.ehr.com/statestreet/Home.

About State Street

Across the globe, institutional investors rely on us to help them manage risk, respond to challenges, and drive performance and profitability. We keep our clients at the heart of everything we do, and smart, engaged employees are essential to our continued success.

We are committed to fostering an environment where every employee feels valued and empowered to reach their full potential. As an essential partner in our shared success, you’ll benefit from inclusive development opportunities, flexible work-life support, paid volunteer days, and vibrant employee networks that keep you connected to what matters most. Join us in shaping the future.

As an Equal Opportunity Employer, we consider all qualified applicants for all positions without regard to race, creed, color, religion, national origin, ancestry, ethnicity, age, disability, genetic information, sex, sexual orientation, gender identity or expression, citizenship, marital status, domestic partnership or civil union status, familial status, military and veteran status, and other characteristics protected by applicable law.

Discover more information on jobs at StateStreet.com/careers

Read our CEO Statement

Job Application Disclosure:

It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.