Lead Application Security Engineer

CAIS is the pioneer in democratizing access to and education about alternative investments for independent financial advisors, empowering them to engage and transact with leading asset managers on a massive scale through a wide variety of alternative investment products and technology solutions. CAIS provides financial advisors with a broad selection of alternative investment strategies, including hedge funds, private equity, private credit, real estate, digital assets, and structured notes. CAIS also delivers industry-leading technology, operational efficiency, and world-class client service throughout the pre-trade, trade, and post-trade experience. CAIS supports over 50,000 advisors who oversee more than $6 trillion in network assets. Application security sits at the center of how CAIS earns and keeps the trust of the advisors and asset managers who rely on our platform. As our lead for application security, you will own how we protect the applications and services we build and embedding security into the heart of how we design, write, and ship software. You will define and drive our approach to secure development: setting threat modeling strategy, owning security architecture and secure code reviews, and designing the controls that live inside our SDLC. Just as importantly, you will use automation and AI to scale that work, turning security from a manual checkpoint into something engineers experience as fast, clear, and genuinely useful. We are looking for a hands-on technical leader who is as comfortable reading production code as setting strategy. You are someone who enjoys partnering with engineers and product owners; you are eager to experiment with new technologies to raise our security bar across the stack, and you are easy to do business with. You see a growing security practice not as a constraint to enforce but as a capability to build, one that helps us ship reliable products, grow as engineers, and have some fun along the way. Responsibilities Secure Software Development & Architecture Own security elements of the software development lifecycle, designing and implementing automated controls within CI/CD, including SAST, DAST, dependency and container security scanning. Conduct security architecture and design reviews across product and platform areas, surfacing risk early and providing clear, actionable remediation paths. Drive CAIS's threat modeling strategy, establishing it as a repeatable practice across teams rather than a one-off exercise. Vulnerability Management & Engineering Partnership Triage, validate, and prioritize findings, coordinating remediation through to resolution with clear ownership and follow-through. Liaise with key vendors on penetration testing, vulnerability scanning, and threat modeling, translating external findings into prioritized action. Partner with engineers and product owners to embed security pragmatically into design, development, and release, supporting teams without becoming a blocke...