<div class="content-intro"><p>At <strong><a href="https://www.wilsonelser.com/">Wilson Elser</a>,</strong> we are redefining what it means to work at a national law firm. With more than 1,400 attorneys across 46 offices nationwide, we are recognized among the top 100 law firms by <em>The American Lawyer</em> and ranked #30 in the <em>National Law Journal’s</em> survey of the nation’s largest law firms.</p> <p>Our continued success is built on a culture of collaboration, innovation, client service, and mutual respect. We are committed to fostering an environment where employees are empowered to grow their careers, contribute meaningfully, and thrive professionally.</p> <p> </p></div><p><strong>The Position</strong></p> <p>We are seeking a Senior Product Security Engineer to build and lead our secure software development and DevSecOps program. This is a program-building role for someone who has stood up application security from the ground up and can set its direction as the Firm continues its move to Azure.</p> <p>You will serve as the bridge between Information Security and Application Development, embedding security into the development lifecycle without slowing delivery. The work spans internally developed applications, CI/CD pipelines, integrations, low-code/no-code platforms, and Azure-hosted services, and includes carrying security practices from the Firm’s traditional Windows infrastructure into cloud-native Azure patterns.</p> <p>The role reports to Information Security with a strong dotted-line partnership into Application Development and Engineering leadership.</p> <p><strong>Key Responsibilities</strong></p> <p><strong>Application Security & Secure Development Lifecycle (SDL)</strong></p> <ul> <li>Build, lead, and mature the SSDLC program, including its roadmap, standards, and success measures</li> <li>Prioritize preventive controls designed into the build process (“baked in, not sprayed on”), using testing to validate secure design rather than replace it</li> <li>Perform application security reviews, threat modeling, secure architecture assessments, and source code review</li> <li>Establish secure coding standards, policies, and “paved road” patterns for common technologies and frameworks</li> </ul> <p><strong>DevSecOps & CI/CD Security</strong></p> <ul> <li>Integrate and optimize SAST, DAST, SCA, API scanning, and IaC scanning within Azure DevOps pipelines</li> <li>Own vulnerability ingestion, triage, prioritization, remediation tracking, and reporting</li> <li>Build dashboards and metrics covering application security posture and remediation SLAs</li> <li>Script integrations to normalize findings across multiple security tools</li> </ul> <p><strong>Security Tooling </strong></p> <ul> <li>Administer and tune Snyk, SonarQube, Azure DevOps, PowerShell scanning tools, and additional AppSec tooling as needed</li> <li>Suppress false positives, write custom detection rules, and identify gaps in tooling coverage</li> <li>Manage security exceptions and remediation timelines with development teams</li> </ul> <p><strong>Cloud & Platform Security</strong></p> <ul> <li>Partner with cloud and infrastructure teams to secure Azure-hosted applications and services</li> <li>Support security reviews across Azure PaaS, containers, Databricks, MongoDB, Data Lake environments, Azure Data Factory, and Power Platform</li> <li>Help secure low-code/no-code platforms and their governance processes</li> </ul> <p><strong>Developer Enablement</strong></p> <ul> <li>Launch and run a Security Champions program within engineering teams</li> <li>Deliver developer-focused training, workshops, and secure coding guidance</li> <li>Mentor developers and upskill Information Security staff on application security concepts and tooling</li> </ul> <p><strong>Qualifications</strong></p> <ul> <li>5+ years in Application Security, Product Security, DevSecOps, or Software Engineering</li> <li>Demonstrated experience building an application security or DevSecOps program from the ground up</li> <li>Experience leading or mentoring technical staff, formally or informally</li> <li>Hands-on experience securing Azure environments and Azure DevOps pipelines, and integrating security tooling into CI/CD</li> <li>Experience with Microsoft/Windows environments and .NET application stacks</li> <li>Strong grounding in secure coding principles, OWASP Top 10, secure SDLC, threat modeling, and vulnerability management</li> <li>Working experience with several of: Azure DevOps, Azure cloud services, Snyk, SonarQube, containers/Kubernetes, PowerShell, Python, .NET, JavaScript, React, PHP</li> <li>Ability to separate meaningful risk from low-value scanner findings</li> <li>Strong scripting and automation skills, with excellent communication and documentation</li> </ul> <p><strong>Preferred Qualifications</strong></p> <ul> <li>Prior experience as a software developer or DevOps engineer</li> <li>Hands-on administration of Snyk and SonarQube</li> <li>Experience bridging on-premises infrastructure to Azure, including container and cloud-native application security</li> <li>Familiarity with low-code/no-code platform security and with OWASP ASVS, Azure Secur