Senior Application Security Engineer - Vice President

About the role

iCapital is building a modern Application Security program. We’re looking for a senior, hands-on engineer to join a small team and help shape how we design, build and secure our applications—from secure design and threat modelling to API security, automation and security checks in CI/CD.

You will sit within the Information Security organization and work directly with the Head of AppSec, engineering teams and product stakeholders. You should enjoy understanding complex applications, investigating weaknesses in code and architecture, and helping developers implement practical fixes.

We’re still developing the program’s processes, so you’ll take ownership of defined technical workstreams and help establish how we work. This role combines hands-on delivery with the ability to set technical direction, influence engineering decisions and build repeatable security practices.

What you’ll do

• Help build and mature the Secure Design and Threat Modeling practice, defining review methodology, standards and sign-off criteria with the Head of AppSec.
• Drive API security posture, assessing exposure, authentication, authorization and business-logic risks.
• Conduct targeted application and API security testing and support offensive security initiatives to identify weaknesses and validate controls.
• Build and maintain Python automation for security workflows, finding triage, data enrichment and integrations with development tools.
• Work with developers to investigate and fix findings from penetration testing, static application security testing (SAST) and software composition analysis (SCA), improving scan quality and reducing unnecessary friction.
• Embed security into development through design reviews, CI/CD checks, secure coding guidance and reusable solutions.
• Establish clear remediation ownership, priorities, timelines and escalation paths, working with engineering teams to validate fixes and resolve risks.

What you’ll bring

• Substantial hands-on application security experience, whether gained in a dedicated security role or through security-focused software engineering work.
• Secure design and threat modeling skills, grounded in practical knowledge of web and API vulnerabilities, exploitation patterns and effective fixes.
• The ability to review application code, investigate security issues and engage with developers at technical depth.
• Python proficiency and experience building maintainable automation that others can rely on.
• Experience integrating security into development workflows through design reviews, developer guidance or CI/CD.
• Comfort owning technical workstreams independently, making risk-based decisions and influencing architecture across engineering and product teams.

We value demonstrated security expertise and engineering ability over specific previous job titles. You should bring depth in the core disciplines, but you do not need to have led every AppSec specialty.

Helpful, but not required

• Deeper experience in application penetration testing, GraphQL security or business-logic testing.
• Familiarity with cloud-native environments and attack surface management.
• Software development experience with Ruby or Scala.
• Experience with AI-assisted security tooling or AI/LLM application security.