About Juniper Square
Private markets are one of the largest, most complex, and most underserved corners of global finance. Our mission at Juniper Square is to unlock their full potential. We’re the Operations Partner trusted by 2,300+ GPs, unifying technology, data, and fund administration services into a single platform that helps GPs move faster, make better decisions, and scale with precision. With $300B+ under administration and 700,000+ LPs on platform, we’ve built the scale to match our ambition. And with JunieAI, our purpose-built AI platform, we’re reimagining how private markets operate, embedding intelligence across every workflow. Founder-led since 2014, backed by $350M+ in funding, and now 1,000+ employees strong, we’re building a company designed to shape the future of private markets for decades to come. Our culture is built for people who want to do ambitious, meaningful work alongside exceptionally talented teammates. We think like owners, move with urgency, and take pride in solving hard problems that truly matter to our customers and the future of private markets. We believe the best ideas come from open debate, deep collaboration, and diverse perspectives, which is why we believe transparency is the default and feedback makes us stronger. If you’re energized by high standards, rapid growth, and the opportunity to help define a category at a pivotal moment, come join us! Juniper Square offers employees a variety of ways to work, ranging from a fully remote experience to working full-time in one of our physical offices. We invest heavily in digital-first operations, allowing our teams to collaborate effectively across 27 U.S. states, 2 Canadian Provinces, India, Luxembourg, and England. We also have physical offices in San Francisco, New York City, Mumbai and Bangalore for employees who prefer to work in an office some or all of the time. About your role As a Senior Engineer - Application and Platform Security on our Platform Engineering team, You’ll find and fix vulnerabilities across our applications and cloud infrastructure. Then you’ll build the guardrails, automation, and secure defaults that keep them from coming back. The role spans application code, build and deployment systems, cloud infrastructure, and our AI-powered features. It’s hands-on: you’ll write production-quality code, ship tools engineers want to use, and use AI agents to multiply your own output. What you will do: Application and product security (your focus)
- Lead security design reviews and threat models for new product features, with depth in authentication, authorization, data isolation, and high-risk financial workflows.
- Perform manual code review and security testing of web applications and APIs. Focus on the authorization and business logic flaws that scanners miss, and drive fixes through to verification.
- Design secure-by-default libraries, framework-level controls, and custom static analysis rules that eliminate whole classes of vulnerabilities.
- Triage application findings from automated and manual testing and external assessments. Group them by root cause and write remediation guidance engineers can act on.
- Threat-model and test AI-powered product features against risks like prompt injection, unsafe tool use, data leakage, and excessive agency. Define secure patterns other teams can reuse.
Shared across the team
- Share design review and triage responsibilities across the team.
- Support our external penetration testing program, from scoping through retest.
- Partner with teammates on build pipeline and supply-chain security, especially dependency risk in application code.
- Participate in incident response for application security events.
- Build security automation and agents that cut review and triage time.
Qualifications
- Experience: 5+ years in application or product security, or in software engineering with a strong security focus.
- Code review: Deep experience finding vulnerabilities through manual review. You find authorization and business logic flaws by reading code, not only by running a scanner.
- Programming: Strong Python, plus working proficiency in JavaScript/TypeScript, enough to review front-end code for client-side issues. You write production-quality code, not just scripts.
- Identity: In-depth knowledge of OAuth 2.0/OIDC, SAML, MFA, session management, and access control models, with hands-on experience implementing them securely.
- Threat modeling: Experience leading threat modeling sessions with engineering teams and turning the output into concrete requirements.
- Security tooling: Experience running and tuning SAST, SCA, and DAST, including writing custom rules.
- Platform awareness: Working knowledge of cloud, container, and CI/CD security, enough to reason about how application design interacts with infrastructure.
- AI security: A working understanding of LLM application risks and the drive to go deep.
- Collaboration: Clear writing and a track record of influencing engineering teams without becoming a bottleneck.
Nice to have
- An offensive web security background, such as bug bounty, web application CVEs, or CTFs. Certifications like OSWE or BSCP are a plus, not a requirement.
- Experience building developer-facing security tooling or libraries.
- Experience building or running a security champions program.
- Familiarity with OWASP ASVS or the OWASP Top 10 for LLM Applications.
