Senior Application Security Engineer (Cloud & Web)

MARS Solutions Group is looking for an experienced Senior Application Security Engineer. Our client is a Law Firm looking for high-quality talent to make a difference. They are known to respect a traditional work week and often extend contracts for added job security and stability.

Location: Milwaukee, WI (3 days a week onsite)

We are seeking a Senior Application Security Engineer who combines deep Azure application-layer security experience with strong modern web (Angular/SPA) engineering skills. This role is ideal for someone who has secured public-facing, high-volume websites, built mitigation against bot/fraud/abuse, and can drive a meaningful step-change in the security posture of our public web platform.

You will work hands-on across the full stack-Angular APIs Azure Front Door/APIM-to design and implement secure patterns, build guardrails, analyze traffic behavior, and protect our public intake surfaces. This is a high-impact role focused on real-world, application-layer defense, not governance or compliance.

• Own and implement security controls across Azure Front Door, WAF, bot rulesets, rate limiting, and traffic shaping.

• Design and maintain APIM security policies (JWT validation, request throttling, input sanitization, IP filtering, threat protection rules).

• Develop and harden secure public-facing APIs, ensuring strong validation and protection against automated abuse.

• Build secure pipelines for file uploads, antivirus scanning, MIME validation, and content safety.

• Analyze traffic patterns to detect bot activity, scraping, fraud attempts, and automated attacks.

• Partner with engineering leads to create secure-by-default templates, guardrails, and architecture patterns.

• Build and enhance Angular SPA features with a strong emphasis on security, performance, and resilience.

• Collaborate with backend teams to improve API authentication, authorization, and validation layers.

• Drive secure patterns between frontend API Azure edge (e.g., input validation, safe API consumption, CSRF-resistant flows).

• Lead technical discussions and guide teams on secure architecture decisions.

• Mentor engineers on modern application security practices.

• Drive cross-team initiatives to reduce risk and harden our public digital footprint.

• Conduct threat modeling, code reviews, and risk assessments for high-exposure user flows.

• 7+ years of experience as a Senior Software Engineer, Full Stack Engineer, or Application Security Engineer.

• Demonstrated experience securing public-facing web applications (high-volume consumer apps strongly preferred).

• Strong hands-on experience with Azure Front Door, WAF rules, bot protection, rate limiting, routing, and global traffic policies.

• Deep experience with Azure API Management (APIM), including advanced policy configuration.

• Solid engineering background with Angular (or React/Vue with willingness to work in Angular).

• Strong understanding of security boundaries: SPA API Cloud edge.

• Experience mitigating bots, fraud, scraping, or automated abuse on public websites.

• Strong skills in modern API security, input validation, secure coding, and threat modeling.

• Experience with upload/file security pipelines.

• Experience with telemetry tools for abuse detection (e.g., Application Insights, Splunk, Kibana, Grafana).

• Familiarity with OWASP, API security best practices, and cloud-native defensive patterns.

• Experience introducing new secure architecture patterns or frameworks across an engineering org.

• Knowledge of secure CI/CD practices and automated scanning tools.

• Senior ICs who are hands-on and love solving real-world abuse challenges.

• Engineers who enjoy both building and defending public applications.

• Individuals who have worked in fintech, ecommerce, marketplaces, travel, or high-volume consumer apps.

• People who are comfortable being the expert and elevating the team around them.

You'll be directly responsible for protecting our most publicly exposed surfaces, ensuring they remain secure, resilient, and trustworthy for all users. Your work will reduce fraud, block attackers, improve reliability, and raise the security maturity of the entire engineering organization.