Senior Product Security Engineer

Description
The application window will close on November 9th, 2026.
Job Location
The primary work location for this role is remote.
The Team You’ll Join
The Product Security Engineering team plays a critical role in protecting Envestnet's WealthTech platforms and the sensitive financial data relied upon by advisors, wealth managers, brokerages, banks and RIAs. The team partners closely with product, engineering, architecture, and infrastructure teams to embed security throughout the software development lifecycle, helping ensure that applications, APIs, cloud services, and AI-powered solutions are secure by design. They lead initiatives spanning application security, DevSecOps, automation, API security, and AI security governance, while driving secure coding practices, threat modeling, vulnerability management, and developer enablement. This is a highly impactful team at the forefront of modern cybersecurity, shaping how security is integrated into innovative financial technology products while enabling the business to deliver trusted solutions at scale.
How You’ll Contribute
Responsible for embedding strong security practices into the design, development and operation of Envestnet financial technology platforms. Partners with product management software engineering, architecture and infrastructure teams to identify and mitigate security risks early in the product lifecycle. Defines secure design standards, performs threat modeling and security reviews and helps teams remediate vulnerabilities in applications, APIs and cloud services.
Identifies application security risks and defines mitigation strategies in various phases of SDLC.
Performs penetration tests on web applications and collaborates with the development team to resolve identified security issues.
Performs code review, collaborating with the development team to incorporate secure coding practices across the organization.
Executes automated scans on web applications using various SAST and DAST tools.
Analyzes, reviews and suggests new application installations, tests various features and functionalities and collaborates with IT helpdesk through the process of application whitelisting.
Performs domain audits with the help of OSNIT tools.
Collaborates with internal and external stakeholders, providing technical support for penetration tests and audit for the products.
Reviews, evaluates and recommends security best practices for AWS cloud specific implementations of SDLC.
Collaborates with engineering team on new project initiatives, reviewing and analyzing project requirements and recommending security best practices.
Performs security audits, reviews security reports, identifies and analyzes legitimacy of bugs to provide security related technical solutions.
Contributes and suggests ideas for the design of application security tools, standards and architectures.
Lead the implementation and operation of Application Security tooling and automation, including SAST, DAST, SCA, IAC security, secrets detection, CI/CD security controls, and developer self-service security capabilites.
Drive Secure SDLC evolution through threat modeling, architecture reviews, code reviews, security testing, and close partnership with development teams to prioritize, remediate, and prevent security vulnerabilities while promoting secure coding practices and developer training.
Develop and operationalize AI Security and AI-SDLC practices, including governance and security guardrails for AI-assisted development, AI-generated code, AI agents, LLM applications, and sensitive data protection.
Establish API Security and MCP governance standards, including API discovery, authentication and authorization controls. secure tool integrations, access governance, offensive security testing, and continuous risk of monitoring for APIs, AI agents, and connected systems.
What You’ll Need to Bring
Strong experience with Application Security tooling, DevSecOps platforms, CI/CD security controls, and security automation.
Hands-on experience with threat modeling, architecture reviews, vulnerability management, developer training, and driving remediation with engineering teams.
Knowledge of AI/LLM security, AI-SDLC frameworks, agentic AI architectures, and AI risk management.
Familiarity with API Security, MCP governance, tool authorization models, AI agent security, and secure AI integrations.
Proficiency in Python, Go, PowerShell, or other automation-focused programming languages.
Candidates should demonstrate the relevant experience, skills, and capabilities needed to successfully perform in the role. Relevant experience may be gained through current responsibilities, prior roles, project work, leadership opportunities, or other comparable experiences.
Nice-to-Haves
Experience building or operating developer self-service security platforms and security-as-code solutions.
Hands-on experience with AI-powered security tools, LLM security testing, prompt injection defenses, or AI agent security assessments.
Familiarity with Application Security Posture Management (ASPM), attack surface management, and risk-based vulnerability prioritization.
Security certifications such as CSSLP, GWEB, OSWE, OSCP, CISSP, or cloud security certifications.
Experience driving Security Champion programs, secure coding initiatives, or developer security training.
Our Investment in You
This role offers a base salary range of $125,900 to $157,400. The range listed represents a good-faith estimate of base salary compensation for this position and does not include incentive compensation, equity or benefits. Individual pay will be determined based on factors including, but not limited to, relevant experience, skills, education, certifications, and geographic location, in accordance with applicable pay transparency laws. This role is eligible for an additional incentive component as part of the total rewards package.
We provide a comprehensive suite of benefits - subject to Envestnet’s plan eligibility rules - that support your overall well-being including, medical insurance, paid time off (PTO), 401k company match, paid parental leave, education reimbursement, disability coverage and mental health & wellness support. Our investment in you means supporting you professionally, financially, and personally at every stage of your journey with us. Please visit our benefits page on our career site to learn more.
Our Commitment to Inclusion & Belonging
Envestnet is an Equal Opportunity Employer and is committed to creating an inclusive environment for all employees and applicants. We welcome and value individuals of all backgrounds and do not discriminate based on race, color, religion, creed, sex (including pregnancy or other related medical conditions), gender identity or expression, sexual orientation, national origin, ancestry, age, disability, genetic information, military or veteran status, citizenship status, or any other status protected by applicable law. We encourage individuals from all backgrounds to apply.
We strive to provide an inclusive application and interview process. If you are a candidate with a disability and require reasonable accommodation, please contact us at [email protected]. Please include your full name, the title of your role you are applying for, and the accommodation necessary to assist you with the recruiting process.
Recruitment Fraud
At Envestnet, safeguarding the trust and safety of job seekers is a top priority. We are aware that scammers may impersonate Envestnet recruiters or create fake job opportunities to deceive candidates. Review the information on our recruitment fraud awareness page to help you recognize and avoid recruitment fraud.

Work arrangement
Yes