Senior Application Security Engineer - Vice President

• Help build and mature the Secure Design and Threat Modeling practice, defining review methodology, standards and sign-off criteria with the Head of AppSec.
• Drive API security posture, assessing exposure, authentication, authorization and business-logic risks.
• Conduct targeted application and API security testing and support offensive security initiatives to identify weaknesses and validate controls.
• Build and maintain Python automation for security workflows, finding triage, data enrichment and integrations with development tools.
• Work with developers to investigate and fix findings from penetration testing, static application security testing (SAST) and software composition analysis (SCA), improving scan quality and reducing unnecessary friction.
• Embed security into development through design reviews, CI/CD checks, secure coding guidance and reusable solutions.
• Establish clear remediation ownership, priorities, timelines and escalation paths, working with engineering teams to validate fixes and resolve risks.

• Substantial hands-on application security experience, whether gained in a dedicated security role or through security-focused software engineering work.
• Secure design and threat modeling skills, grounded in practical knowledge of web and API vulnerabilities, exploitation patterns and effective fixes.
• The ability to review application code, investigate security issues and engage with developers at technical depth.
• Python proficiency and experience building maintainable automation that others can rely on.
• Experience integrating security into development workflows through design reviews, developer guidance or CI/CD.
• Comfort owning technical workstreams independently, making risk-based decisions and influencing architecture across engineering and product teams.

We value demonstrated security expertise and engineering ability over specific previous job titles. You should bring depth in the core disciplines, but you do not need to have led every AppSec specialty.

• Deeper experience in application penetration testing, GraphQL security or business-logic testing.
• Familiarity with cloud-native environments and attack surface management.
• Software development experience with Ruby or Scala.
• Experience with AI-assisted security tooling or AI/LLM application security.

We believe the best ideas and innovation happen when we are together. Employees in this role will work in the office four days, with the flexibility to work remotely one day (Friday).

iCapital offers a comprehensive benefits package that includes a total compensation program consisting of competitive salary, annual performance bonus, and equity for all full-time employees; healthcare with 100% employer-paid health and dental insurance; and generous paid time off (PTO).

For additional information on iCapital Network, please visit https://www.icapitalnetwork.com/about-us Twitter: @icapitalnetwork | LinkedIn: https://www.linkedin.com/company/icapital-network-inc