Morgan Stanley
Senior AppSec Engineer
Remote Developer role with clear candidate location fit.
PostedJun 17, 2026
Eligible countries1 accepted country
Seniority signalSenior
Work settingRemote
Accepted candidate locations
India
Role overview
Senior AppSec Engineer
Requirements and responsibilities
Readable role content extracted into sections for faster review.
About the role
We are looking for a Senior Application Security Engineer to architect and build automated security layers within the SDLC, engineering AI-enabled secure code scanning, hardened baseline automation, and CI/CD security tooling integration within a large-scale financial services program. You will work primarily in Python to build automated security runbooks, deploy and tune scanning tools, and provide code-level remediation guidance to development teams — operating with full autonomy and no daily supervision. AppSec and DevSecOps experience is strongly preferred; SAST/DAST/SCA and Java expertise are a plus.
What you will do
- Engineer and deploy AI-enabled secure code scanning capabilities and “Golden Images” to drive secure-from-the-start adoption;
- Automate the development of secure coding patterns and integrate them with traditional and Agentic SDLC workflows;
- Architect the integration of continuous security scanning tools (SAST, DAST, SCA) into enterprise CI/CD pipelines, tuning them to eliminate noise;
- Act as a senior technical SME, reading and reviewing complex application code (Java/Python) to provide software engineers with code-level remediation guidance.
Must haves
- 5+ years of software engineering experience, ideally with a focus on Application Security and DevSecOps;
- Strong coding and architectural proficiency in Python for security automation and scripting;
- Fully autonomous execution capability, requiring no daily supervision to map out and build automated security runbooks;
- Upper-intermediate English level.
Nice to haves
- Deep, hands-on expertise deploying and tuning modern application security testing tools, including SAST, DAST, and SCA, and integrating them into complex CI/CD orchestration ecosystems;
- Experience integrating LLMs, AI agents, or automated coding assistants to streamline vulnerability triaging or secure code generation;
- Advanced application threat modeling experience;
- Ability to confidently read, review, and secure enterprise source Java code.
Similar roles
Keep a backup shortlist.
Devsecops, Java 6 accepted countries
Senior AppSec EngineerMorgan StanleyView role Java, Python India
Senior Technical LeadMorgan StanleyView role Java, Python 6 accepted countries
Application Security Engineer (Tech Lead)Morgan StanleyView role Java, Python 8 accepted countries
Senior Technical LeadMorgan StanleyView role Stack
Use these tags to compare similar remote roles.
Location eligibility
Candidates should apply only when their profile country is listed here.
Your profileCountry not setSign in to check your country against this role.
Hiring flow
Applications are saved in WithMira for review and follow-up.
1Apply with your profile and resume snapshot.
2Recruiter reviews your fit for this position.
3Messages and recruiter decisions stay attached to this role.