This role suits an experienced, hands-on security professional who wants to lead application and AI security as the first dedicated security hire for Savvy in New York City. The Staff Application and AI Security Engineer position focuses on building guardrails for AI-assisted development, managing vulnerabilities, and securing cloud and SaaS environments.
Role Overview
Savvy seeks a Senior Application Security Engineer to join its headquarters in New York City as the first dedicated security hire. Operating in a hands-on capacity, the engineer executes security strategy alongside leadership, focusing purely on identifying and eliminating technical vulnerabilities without handling compliance or GRC duties. The role is vital for balancing speed and security within an AI-forward wealth management technology environment.
Key Responsibilities
Own vulnerability management end to end by identifying, triaging, and prioritizing risks across products, codebases, and cloud infrastructure including AWS, GCP, and Cloudflare.
Build and operate the AppSec tooling pipeline, covering secrets scanning, SCA and dependency scanning with triage SLAs, and SAST rollout on sensitive repositories.
Set and enforce codebase security hygiene standards, incorporating code review standards that account for AI-generated code authorship and mandatory human reviews.
Partner with the internal AI team to design guardrails for AI-assisted development and non-technical builders, including sanctioned tooling, data boundaries, and dependency vetting.
Secure the SaaS stack by hardening configurations, reviewing OAuth grants, and reducing misconfigurations across tools like Google Workspace, GitHub, Rippling, and Slack.
Establish conditional access and identity-layer controls alongside IT, such as SSO, phishing-resistant MFA, and managed-device posture.
Define cloud and SaaS configuration baselines for the operational infrastructure footprint.
Contribute to detection and response readiness by creating high-signal detections and participating in incident response when required.
Work cross-functionally with Engineering, IT, and internal AI teams to clearly articulate risks, remediation paths, and tradeoffs.
Requirements
Five or more years of hands-on security engineering experience with a strong focus on application or product security.
Strong software engineering fundamentals with the ability to read, write, and remediate code directly.
Track record of enforcing security across technical and non-technical teams without hindering workflow velocity.
Experience embedding security directly into existing workflows rather than applying it as an afterthought.
Deep familiarity with modern AppSec toolchains, including secrets scanning, SCA, SAST, and GitHub-centric CI/CD security integration.
Practical background in securing SaaS environments through OAuth review, configuration hardening, and least-privilege access design.
Working knowledge of cloud security across AWS and GCP, as well as Cloudflare edge and CDN security.
Pragmatic, risk-based mindset focused on prioritizing actual exploitation vectors and shipping iteratively.
Strong perspective on AI-assisted development security, understanding risks like hallucinated dependencies and leaked secrets.
Excellent communication skills, independent working style, and strong writing skills suited for a written culture.
Nice to Have
Experience building security programs from reactive to systematic at early-to-mid stage companies.
Experience with SaaS security posture management, CSPM, or identity threat detection.
Familiarity with securing LLM-based tooling, agentic workflows, or internal AI platforms.
Detection engineering experience with SIEM, MDR, or high-signal alerting.
Background in fintech or financial services environments.
Offensive security background in pentesting, bug bounty, or red teaming.
Skills and Tools
AWS
GCP
Cloudflare
GitHub
Google Workspace
Rippling
Slack
SAST
SCA
CI/CD tooling
Salary and Benefits
Competitive salary ranging from $220K to $250K with equity offers
Unlimited PTO and paid company holidays
Holistic medical, dental, and vision plans
Company 401(k) with Mega backdoor Roth options, commuter benefits, and HSA/FSA plans
Office located in Union Square, NYC, featuring provided lunch, snacks, and dinner for late stays
Access to Spring Health virtual mental health care and Rightway health concierge
Guardian WorkLifeMatters EAP counseling for stress management, dependent care, nutrition, fitness, legal, and financial issues
About the Company
Savvy is a registered investment advisor and financial technology company reinventing the wealth management industry by providing independent advisors with a modern, AI-native platform. Backed by $200M raised with a Series C backing, Savvy supports independent advisors who service households more efficiently through proprietary tech, in-house marketing, investment management, and operational support. Recognized as a Great Place to Work, Savvy features a fast-growing team of over 170 employees.
How to Apply
Interested candidates should visit the official Savvy careers page to submit an application for this role.
