Application Security Engineer Jobs in New York
Application Security Engineer jobs in New York are among the most active in the country, concentrated in financial services, technology, media, and healthcare sectors with demand at every level from entry-level analyst to senior architect. Most hiring is in New York City, with secondary clusters in Albany and Buffalo, where employers like JPMorgan Chase, Citigroup, and IBM have deep, lasting engineering footprints. The most sought-after specializations include secure software development lifecycle practices, cloud-native security architecture, and penetration testing for regulated industries. Find a role that fits below and apply directly.
Find JobsOverview
Showing 5 of 27+ Application Security Engineer jobs
About Lantern
Lantern is the specialty care platform connecting people with the best care when they need it most. By curating a Network of Excellence comprised of the nation's top specialists for surgery, cancer care, infusions and more, Lantern delivers excellent care with significant cost savings to employers and their workforces. Lantern also pairs members with a dedicated care team, including Care Advocates and nurses, for the entirety of their care journey, helping them get back to good health, back to their families and back to work. With convenient access to specialists nationwide, Lantern means quality care is within driving distance for most. Lantern is trusted by the nation's largest employers to deliver care to more than 6 million members across the country. Learn more about us at lanterncare.com.
Lantern is the specialty care platform, connecting people with high-quality, affordable specialty care close to home. We operate in a regulated healthcare environment (HIPAA, HITRUST, SOC 2), we handle protected health information at scale, and we are becoming an AI healthcare company, with AI adoption a top company priority.
The Director, Application & AI Security owns application and AI security end to end: the security of the software and the AI systems Lantern builds. It is the seat most directly tied to our AI strategy. The job is to make it safe to move fast, building the golden paths and secure defaults that let teams ship product and adopt AI without waiting in a permission queue, while keeping PHI and external-model data egress genuinely protected.
You will lead a growing function. At hire, the team includes a senior application security engineer, with several open roles to fill across security architecture, AI/ML security, DevSecOps, and product security. You will build that team and set the secure-design standards the whole engineering organization builds against.
Our security philosophy is open by default, secure by design. Security exists to help the business move fast, safely, and the default answer is "yes, safely," because guardrails are built into the platform, pipelines, and tooling rather than enforced by someone saying no. Gates exist only where risk genuinely warrants them, and even then they are automated, fast, and transparent.
Location: Hybrid - at least 3 days/wk in our NYC, NY offices
Responsibilities:
- Own application security across the development lifecycle, covering static, dynamic, and interactive analysis (SAST/DAST/SCA/IAST), code and dependency security, API security, and runtime protections such as WAF and API gateways, all delivered through engineering teams rather than filed as findings.
- Own AI and ML security, including model and agent security, prompt-injection and tool-use risk, and data-egress controls for third-party model providers, plus continuous AI security posture management informed by the OWASP LLM Top 10, MITRE ATLAS, and AI risk-management standards (NIST AI RMF, ISO/IEC 42001).
- Own security architecture and threat modeling, including secure-by-design review and ownership of cryptographic standards.
- Own DevSecOps and pipeline security, with scanning as a default in CI/CD and MLOps/LLMOps pipelines, release gating calibrated to risk, and software supply chain and SBOM practice.
- Own the security-review intake as a single front door with risk-based triage, reported against a turnaround commitment, so security accelerates the business rather than bottlenecking it.
- Own the application and AI security tool stack and the secure-design standards behind it.
Key Deliverables in Your First Year:
- An AI golden path: an approved-model catalog and automated data-egress controls, so teams adopt AI on a governed route instead of case-by-case approvals.
- A secure SDLC paved road, with scanning in the pipeline by default and critical findings resolved within SLA.
- A single security-review intake that delivers fast, risk-based answers on a published turnaround.
- A built-out team, with the open roles filled and performing.
How You Will Work:
Much of this scope is delivered in partnership. Engineering carries remediation on application, API, and dependency findings. Platform Engineering operates the CI/CD pipelines you secure. AI Engineering builds the model integrations you govern on the security side, while the Governance, Risk & Compliance team owns AI use governance, meaning acceptable use, model inventory, and third-party model data-egress scoping, as the companion to your security accountability. Setting and holding clear service expectations across these partners is part of the role.
Requirements:
- A minimum of 8 years application or product security.
- A minimum of 3 years leading a team with function-level accountability.
- Demonstrated AI and ML security ownership at production scale, including model and agent security, prompt-injection and tool-use risk, and data-egress control for third-party model providers, with working fluency in the OWASP LLM Top 10, MITRE ATLAS, and AI risk-management standards (NIST AI RMF, ISO/IEC 42001).
- Secure SDLC leadership across static, dynamic, and interactive analysis (SAST/DAST/SCA/IAST), dependency and software supply-chain risk, SBOM practice, and remediation delivered through engineering teams.
- Security architecture and threat-modeling depth, with the standing to review a design and be heard by senior engineers.
- DevSecOps and pipeline security experience, including scanning as a default in CI/CD, risk-calibrated release gating, and pipeline secret handling.
- API security experience on a platform handling regulated data.
- A track record of delivering security as paved roads and secure defaults rather than review gates, with evidence of adoption.
- Bachelor's degree in a relevant field, or equivalent professional experience.
Strong Candidates Will:
- Healthcare or another regulated domain where PHI or comparable data flows through AI systems.
- Experience standing up an AI golden path, including an approved-model catalog, a governed adoption route, and automated egress controls.
- Experience building a single security-review intake with risk-based triage and a turnaround commitment.
- Cryptographic standards ownership, including customer-managed key models.
- Hands-on familiarity with tools such as Snyk, GitHub Advanced Security, AI security posture management (for example, Wiz), and AI-assisted code scanning.
- Familiarity with AI red-teaming and adversarial-testing tooling (for example, Garak, PyRIT, Promptfoo).
- Product security experience shipping customer-facing security features as differentiators.
- Experience hiring and building a team from a single senior individual contributor.
- CSSLP, OSWE, GWAPT, or equivalent.
Who Thrives in This Role:
- Guardrails over gates. You instinctively ask how to remove a queue rather than how to staff one.
- Engineering credibility. You earn influence with builders through technical depth, not process authority.
- Risk calibration. You reserve genuine gates for what earns them, namely PHI exposure, external model egress, and privileged access, and you keep even those automated and fast.
- Delivery orientation. You treat a roadmap as a commitment with dates.
- Team building. You can grow a function from one senior IC and a set of open roles.
Benefits
- Medical Insurance
- Dental Insurance
- Vision Insurance
- Short & Long Term Disability
- Life Insurance
- 401k with company match
- Flexible Time Off
- Paid Parental Leave
The salary range for this position is $200,000 - $275,000 annually, based on experience, skills, and qualifications. This position is also eligible for an annual bonus, separate from and in addition to the base salary range listed above. Lantern provides this range in good faith in compliance with New York's pay transparency requirements.
About You:
- You use LOGIC in your decision making and understand that progress is critical to making change. You focus on the execution of your content while balancing a fast-paced environment and you take the time to celebrate both the small & big wins.
- INCLUSION is a core tenant of your personal beliefs. A diverse and inclusive environment is incredibly important to you. You understand and desire to be a part of a diverse team with different experiences and perspectives & you cherish the differences in each individual that you interact with.
- You have the GRIT, drive and ambition to tackle big problems. Big problems require big ideas and a team that supports new ideas.
- You care deeply for your customers are driven to keep HUMANITY in all decisions. Your customers aren't just the individuals using your product. They are the driving factor in your motivation to make a change.
- Integrity guides you in life. Focusing on the TRUTH vs. giving people the answers they want to hear.
- You thrive in a Team Environment. Collaboration is key in innovation and creating change.
These pillars of LIGHT are a reminder to our team that we are making a difference by providing guidance and support in navigating the often complex and confusing landscape of healthcare. We hope that through this LIGHT, individuals can find their way to the best care, resources, and support they need to get back to life.
If this sounds like you, we would love to connect to speak further about career opportunities at Lantern.
Please apply to our role & someone from our Talent Acquisition Team will reach out to help you navigate our interview process.
Lantern does not discriminate on the basis of race, sex, color, religion, age, national origin, marital status, disability, veteran status, genetic information, sexual orientation, gender identity or any other reason prohibited by law in provision of employment opportunities and benefits.
About Lantern
Lantern is the specialty care platform connecting people with the best care when they need it most. By curating a Network of Excellence comprised of the nation's top specialists for surgery, cancer care, infusions and more, Lantern delivers excellent care with significant cost savings to employers and their workforces. Lantern also pairs members with a dedicated care team, including Care Advocates and nurses, for the entirety of their care journey, helping them get back to good health, back to their families and back to work. With convenient access to specialists nationwide, Lantern means quality care is within driving distance for most. Lantern is trusted by the nation's largest employers to deliver care to more than 6 million members across the country. Learn more about us at lanterncare.com.
Lantern is the specialty care platform, connecting people with high-quality, affordable specialty care close to home. We operate in a regulated healthcare environment (HIPAA, HITRUST, SOC 2), we handle protected health information at scale, and we are becoming an AI healthcare company, with AI adoption a top company priority.
The Director, Application & AI Security owns application and AI security end to end: the security of the software and the AI systems Lantern builds. It is the seat most directly tied to our AI strategy. The job is to make it safe to move fast, building the golden paths and secure defaults that let teams ship product and adopt AI without waiting in a permission queue, while keeping PHI and external-model data egress genuinely protected.
You will lead a growing function. At hire, the team includes a senior application security engineer, with several open roles to fill across security architecture, AI/ML security, DevSecOps, and product security. You will build that team and set the secure-design standards the whole engineering organization builds against.
Our security philosophy is open by default, secure by design. Security exists to help the business move fast, safely, and the default answer is "yes, safely," because guardrails are built into the platform, pipelines, and tooling rather than enforced by someone saying no. Gates exist only where risk genuinely warrants them, and even then they are automated, fast, and transparent.
Location: Hybrid - at least 3 days/wk in our NYC, NY offices
Responsibilities:
- Own application security across the development lifecycle, covering static, dynamic, and interactive analysis (SAST/DAST/SCA/IAST), code and dependency security, API security, and runtime protections such as WAF and API gateways, all delivered through engineering teams rather than filed as findings.
- Own AI and ML security, including model and agent security, prompt-injection and tool-use risk, and data-egress controls for third-party model providers, plus continuous AI security posture management informed by the OWASP LLM Top 10, MITRE ATLAS, and AI risk-management standards (NIST AI RMF, ISO/IEC 42001).
- Own security architecture and threat modeling, including secure-by-design review and ownership of cryptographic standards.
- Own DevSecOps and pipeline security, with scanning as a default in CI/CD and MLOps/LLMOps pipelines, release gating calibrated to risk, and software supply chain and SBOM practice.
- Own the security-review intake as a single front door with risk-based triage, reported against a turnaround commitment, so security accelerates the business rather than bottlenecking it.
- Own the application and AI security tool stack and the secure-design standards behind it.
Key Deliverables in Your First Year:
- An AI golden path: an approved-model catalog and automated data-egress controls, so teams adopt AI on a governed route instead of case-by-case approvals.
- A secure SDLC paved road, with scanning in the pipeline by default and critical findings resolved within SLA.
- A single security-review intake that delivers fast, risk-based answers on a published turnaround.
- A built-out team, with the open roles filled and performing.
How You Will Work:
Much of this scope is delivered in partnership. Engineering carries remediation on application, API, and dependency findings. Platform Engineering operates the CI/CD pipelines you secure. AI Engineering builds the model integrations you govern on the security side, while the Governance, Risk & Compliance team owns AI use governance, meaning acceptable use, model inventory, and third-party model data-egress scoping, as the companion to your security accountability. Setting and holding clear service expectations across these partners is part of the role.
Requirements:
- A minimum of 8 years application or product security.
- A minimum of 3 years leading a team with function-level accountability.
- Demonstrated AI and ML security ownership at production scale, including model and agent security, prompt-injection and tool-use risk, and data-egress control for third-party model providers, with working fluency in the OWASP LLM Top 10, MITRE ATLAS, and AI risk-management standards (NIST AI RMF, ISO/IEC 42001).
- Secure SDLC leadership across static, dynamic, and interactive analysis (SAST/DAST/SCA/IAST), dependency and software supply-chain risk, SBOM practice, and remediation delivered through engineering teams.
- Security architecture and threat-modeling depth, with the standing to review a design and be heard by senior engineers.
- DevSecOps and pipeline security experience, including scanning as a default in CI/CD, risk-calibrated release gating, and pipeline secret handling.
- API security experience on a platform handling regulated data.
- A track record of delivering security as paved roads and secure defaults rather than review gates, with evidence of adoption.
- Bachelor's degree in a relevant field, or equivalent professional experience.
Strong Candidates Will:
- Healthcare or another regulated domain where PHI or comparable data flows through AI systems.
- Experience standing up an AI golden path, including an approved-model catalog, a governed adoption route, and automated egress controls.
- Experience building a single security-review intake with risk-based triage and a turnaround commitment.
- Cryptographic standards ownership, including customer-managed key models.
- Hands-on familiarity with tools such as Snyk, GitHub Advanced Security, AI security posture management (for example, Wiz), and AI-assisted code scanning.
- Familiarity with AI red-teaming and adversarial-testing tooling (for example, Garak, PyRIT, Promptfoo).
- Product security experience shipping customer-facing security features as differentiators.
- Experience hiring and building a team from a single senior individual contributor.
- CSSLP, OSWE, GWAPT, or equivalent.
Who Thrives in This Role:
- Guardrails over gates. You instinctively ask how to remove a queue rather than how to staff one.
- Engineering credibility. You earn influence with builders through technical depth, not process authority.
- Risk calibration. You reserve genuine gates for what earns them, namely PHI exposure, external model egress, and privileged access, and you keep even those automated and fast.
- Delivery orientation. You treat a roadmap as a commitment with dates.
- Team building. You can grow a function from one senior IC and a set of open roles.
Benefits
- Medical Insurance
- Dental Insurance
- Vision Insurance
- Short & Long Term Disability
- Life Insurance
- 401k with company match
- Flexible Time Off
- Paid Parental Leave
The salary range for this position is $200,000 - $275,000 annually, based on experience, skills, and qualifications. This position is also eligible for an annual bonus, separate from and in addition to the base salary range listed above. Lantern provides this range in good faith in compliance with New York's pay transparency requirements.
About You:
- You use LOGIC in your decision making and understand that progress is critical to making change. You focus on the execution of your content while balancing a fast-paced environment and you take the time to celebrate both the small & big wins.
- INCLUSION is a core tenant of your personal beliefs. A diverse and inclusive environment is incredibly important to you. You understand and desire to be a part of a diverse team with different experiences and perspectives & you cherish the differences in each individual that you interact with.
- You have the GRIT, drive and ambition to tackle big problems. Big problems require big ideas and a team that supports new ideas.
- You care deeply for your customers are driven to keep HUMANITY in all decisions. Your customers aren't just the individuals using your product. They are the driving factor in your motivation to make a change.
- Integrity guides you in life. Focusing on the TRUTH vs. giving people the answers they want to hear.
- You thrive in a Team Environment. Collaboration is key in innovation and creating change.
These pillars of LIGHT are a reminder to our team that we are making a difference by providing guidance and support in navigating the often complex and confusing landscape of healthcare. We hope that through this LIGHT, individuals can find their way to the best care, resources, and support they need to get back to life.
If this sounds like you, we would love to connect to speak further about career opportunities at Lantern.
Please apply to our role & someone from our Talent Acquisition Team will reach out to help you navigate our interview process.
Lantern does not discriminate on the basis of race, sex, color, religion, age, national origin, marital status, disability, veteran status, genetic information, sexual orientation, gender identity or any other reason prohibited by law in provision of employment opportunities and benefits.
See All 27 Application Security Engineer Jobs in New York
Find roles in New York that match your experience and apply in just a few clicks.
Find JobsApplication Security Engineer Jobs by City in New York
Where New York roles are concentrated, by current openings.
Application Security Engineer Job Market in New York
A snapshot from current New York openings, updated as new roles post.
Who's Hiring
Top Industries Hiring
- Science & Research
- Technology & Software
- Investment & Asset Management
- Insurance
What New York Employers Look For
The qualifications that appear most often in application security engineer jobs across New York.
- Bachelor's degree in computer science, information security, or a closely related field
- Hands-on experience with SAST, DAST, and software composition analysis tools
- Proficiency in at least one programming language such as Java, Python, or Go
- Industry certification such as CISSP, CEH, or GWEB recognized by New York employers
- Working knowledge of OWASP Top 10 and secure coding standards for web and API applications
- Experience with cloud security controls across AWS, Azure, or GCP environments
Application Security Engineer Jobs in New York: Frequently Asked Questions
How do you become a application security engineer in New York?
There is no state-issued license required to work as an application security engineer in New York, so the path focuses on education and credentials recognized by employers. Most roles require a bachelor's degree in computer science, cybersecurity, or software engineering. Earning certifications such as CISSP, CEH, or GWEB strengthens your profile significantly for the financial services and technology sectors that dominate New York hiring. Building a portfolio demonstrating code review, threat modeling, and penetration testing experience is equally important for competitive positions.
How much do application security engineers make in New York?
Application security engineers in New York earn a median of about $166,180 a year, based on May 2025 Bureau of Labor Statistics wage data, ranging from around $97,430 for the lowest 10% to over $224,590 for the top 10%. Pay rises with experience, specialty, and employer.
Which companies hire application security engineers in New York?
Employers hiring application security engineers in New York right now include Gemini, Danaher, and Anthropic, based on current listings on Migrate Mate as of September 2026. New York's concentration of global financial institutions and large technology firms means demand for application security engineers is consistently high and spread across a diverse range of regulated industries.
Which New York cities have the most application security engineer jobs?
New York, New York State, and Brooklyn have the most application security engineer openings in New York. New York City accounts for the largest share by far due to its density of major banks, fintech companies, media organizations, and healthcare systems, while Albany's government and state agency presence and Buffalo's growing technology and insurance sector drive openings outside the metro.
Are there remote application security engineer jobs in New York?
Yes, and more than most technical fields. About 83% of application security engineer openings tied to New York are remote or hybrid as of September 2026, reflecting that code review, threat modeling, and security tooling work is largely desk-based. Roles that involve on-site penetration testing, regulated financial system access, or government contract work are more likely to require in-person presence.
How can I get hired as a application security engineer in New York with little or no experience?
The most realistic entry path is moving into application security from a software development or IT role, since New York's large financial and technology employers frequently hire developers with a demonstrated interest in security. Large institutions like Citigroup, JPMorgan Chase, and major healthcare systems run rotational technology analyst programs and early-career cybersecurity tracks for new graduates. Earning an entry-level credential such as CompTIA Security+ and building a portfolio with a bug bounty participation or a capstone secure coding project gives candidates a concrete edge in New York interviews.
Where can I find and apply to application security engineer jobs in New York?
You can find and apply to application security engineer jobs in New York on Migrate Mate, which lists current openings from New York employers across finance, technology, healthcare, and government contracting. Find the roles that fit your experience and apply directly to each one.
See All 27 Application Security Engineer Jobs in New York
Find roles in New York that match your experience and apply in just a few clicks.
Find Jobs