> Markdown version of [/jobs/ext/1457888-lead-application-security-devsecops-ai-driven-software-assurance](https://www.wearedevelopers.com/jobs/ext/1457888-lead-application-security-devsecops-ai-driven-software-assurance). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Lead Application Security - DevSecOps & AI-Driven Software Assurance - **Company:** East West Bank - **Location:** Dallas, TX, United States - **Experience:** Expert - **Salary:** $120,000.0 - $180,000.0 - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Application Lifecycle Management, Software System Penetration Testing, Burp Suite, Code Review, Cyber Security, Github, Monitoring of Systems, Open Source Technology, Program Analysis, Proprietary Software, Reverse Engineering, Secure Coding, Web Application Security, Systems Integration, Software Vulnerability Management, Delivery Pipeline, Software Security, Cyber Threat Analysis, Devsecops, Static Application Security Testing, Vulnerability Analysis, Dynamic Application Security Testing - **Published:** July 27, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=242e9aabf88053b0 ## About the Role * Proven experience in application security, DevSecOps, or software security analysis. * Strong hands-on expertise in: * + SAST/DAST tools and secure SDLC practices * + GitHub and open-source ecosystems * + GitHub Advanced Security * Experience with third-party software risk analysis, software composition analysis (SCA), or reverse engineering / binary analysis * Familiarity with software supply chain security and trust validation frameworks * Experience integrating threat intelligence into security decision-making * Strong understanding of secure SDLC, threat modeling (e.g., STRIDE), and vulnerability management. * Experience coordinating penetration tests and working with third-party vendors. * Strong communication and stakeholder engagement skills. Applicants must have legal authorization to work in the United States. We do not offer visa sponsorship at this time. Compensation: The base pay range for this position is USD $120,000.00/Yr. - USD $180,000.00/Yr. Exact offers will be determined based on job-related knowledge, skills, experience, and location. ## Description The Senior Cyber Security Engineer will lead and execute security initiatives across the application lifecycle, integrating security into DevOps pipelines, managing vulnerability assessments, and coordinating penetration testing efforts. This role also extends into advanced software assurance, including third-party software analysis, binary-level inspection, and application trust validation, ensuring that both internally developed and externally sourced applications meet the bank's security standards prior to execution within the enterprise environment. Responsibilities: Application Security & DevSecOps Integration * Embed security controls into CI/CD pipelines using GitHub workflows and automation tools. * Collaborate with development teams to implement secure coding practices and threat modeling during design and development phases. * Manage GitHub Advanced Security configurations, including secret scanning, push protection, and impact analysis. Security Testing & Vulnerability Management * Conduct Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) using approved tools (e.g., CodeQL, Dependabot,, OWASP ZAP). * Perform manual and automated code reviews to identify vulnerabilities and ensure remediation through code fixes or configuration changes. * Maintain accurate mapping of applications to GitHub repositories to support vulnerability tracking and reporting. Advanced Software Analysis & Trust Establishment * Perform security analysis of third-party software, including both source code review and compiled binary analysis where source is not available. * Conduct binary decomposition and reverse engineering techniques, as appropriate, to evaluate software behavior and identify embedded risks. * Support the establishment and execution of a software trust and reputation framework, enabling secure decision-making for application onboarding and whitelisting within the enterprise environment. * Analyze open-source and GitHub-hosted code, including dependencies and contribution risk. * Partner with AppSec leadership to support application security activities and formalize secure software approval processes. API & Web Application Security * Conduct API security assessments and integrate monitoring tools to protect application endpoints. * Support WAF policy management and application-layer threat monitoring. * Threat Intelligence Integration * Integrate threat intelligence insights into software risk assessments, including monitoring for newly disclosed vulnerabilities or exposures in previously approved software. * Reassess software trust posture when threat conditions change, ensuring continuous validation of approved applications. Penetration Testing & Third-Party Risk * Integrate threat intelligence insights into software risk assessments, including monitoring for newly disclosed vulnerabilities or exposures in previously approved software. * Reassess software trust posture when threat conditions change, ensuring continuous validation of approved applications. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [DevSecOps: Injecting Security into Mobile CI/CD Pipelines](https://www.wearedevelopers.com/videos/273-devsecops-injecting-security-into-mobile-ci-cd-pipelines) - [How to Cause (or Prevent) a Massive Data Breach- Secure Coding and IDOR](https://www.wearedevelopers.com/videos/39-how-to-cause-or-prevent-a-massive-data-breach-secure-coding-and-idor) - [Innovating Developer Tools with AI: Insights from GitHub Next](https://www.wearedevelopers.com/videos/1268-innovating-developer-tools-with-ai-insights-from-github-next) - [Real-World Security for Busy Developers](https://www.wearedevelopers.com/videos/1545-real-world-security-for-busy-developers) - [DevSecOps culture](https://www.wearedevelopers.com/videos/783-devsecops-culture) ## Related Articles - [Why Attend a Developer Event in 2026?](https://www.wearedevelopers.com/magazine/688-why-attend-a-developer-event-in-2026) - [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers) - [Best Countries for Software Engineers](https://www.wearedevelopers.com/magazine/267-best-countries-for-software-engineers) - [Software Engineer Salary London](https://www.wearedevelopers.com/magazine/252-software-engineer-salary-london) - [The 12 Best Jobs for Software Engineers](https://www.wearedevelopers.com/magazine/401-the-12-best-jobs-for-software-engineers) - [Top-Paying Tech Jobs (with Salaries)](https://www.wearedevelopers.com/magazine/372-top-paying-tech-jobs-with-salaries)