> Markdown version of [/jobs/ext/3892695-lead-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/3892695-lead-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Lead Application Security Engineer - **Company:** Raymond James Financial, Inc. - **Location:** St. Petersburg, FL, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Java (Programming Language), JavaScript (Programming Language), Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Software System Penetration Testing, Systems Engineering, JIRA, Automation of Tests, Microsoft Azure, C Sharp (Programming Language), Client Server Models, Code Review, Continuous Integration, DevOps, Data-Flow Analysis, Github, Mobile Application Software, Python (Programming Language), Machine Learning, Open Web Application Security, Windows PowerShell, Systems Development Life Cycle, Secure Coding, Security Software, Session Management, Shell Script, Software Engineering, Systems Integration, TypeScript, Web Applications, Google Cloud, Spring Cloud, Software Security, Gitlab, GWAPT, Kubernetes, Production Code, Graphql, Webhooks, Devsecops, Api Management, Serverless Computing, Security Orchestration, Automation & Response, Jenkins, Static Application Security Testing, Vulnerability Analysis, Golang, Dynamic Application Security Testing - **Published:** October 23, 2026 - **Apply:** https://www.techcareers.com/job.asp?id=3466657146&tx=JT989TYI&pt=1&aff=0B19D771-A501-4A5E-8338-2A822B784D54&utm_source=Job%20Feed&utm_medium=textkernel&utm_campaign=DE&utm_term=0B19D771-A501-4A5E-8338-2A822B784D54 ## About the Role * Demonstrated expertise identifying, validating, explaining, and remediating application and API vulnerabilities, including vulnerability classes represented in the OWASP Top 10 and OWASP API Security Top 10. * Advanced understanding of authentication, authorization, session management, cryptography, input handling, deserialization, server-side request forgery, business-logic abuse, and modern client/server attack surfaces. * Hands-on experience with SAST, DAST, IAST, SCA, API testing, secrets detection, container scanning, infrastructure-as-code scanning, and penetration-testing tools; ability to tune controls and validate tool output rather than rely solely on scanner severity. * Strong automation and software engineering capability in Python and at least one of PowerShell, JavaScript/TypeScript, Go, Java, C#, or shell; experience consuming REST/GraphQL APIs, processing structured data, writing tests, and maintaining production-quality code. * Experience integrating security tools with CI/CD and engineering platforms such as GitHub, GitLab, Azure DevOps, Jenkins, Jira, or comparable technologies. * Demonstrated experience applying AI-assisted or machine-learning-enabled security tooling to source-code review, vulnerability triage, exploit-path analysis, test generation, remediation support, or finding correlation. * Experience securing cloud-native applications on Microsoft Azure, Amazon Web Services, and/or Google Cloud Platform, including identity, secrets, workloads, APIs, containers, serverless services, and Kubernetes. * Ability to communicate technical risk clearly to developers, architects, executives, auditors, and non-technical stakeholders, and to translate findings into prioritized engineering actions. * Ability to lead through influence, exercise sound judgment under uncertainty, mentor others, and balance security outcomes with client and business needs. Previous Experience: * Typically requires 3 or more years of hands-on application security, product security, penetration testing, secure software development, or software security assessment experience. * Demonstrated experience developing security automation and integrating application security controls into CI/CD workflows. Certifications: One or more of the following certifications, or the ability to obtain a relevant certification within one year, is preferred: * GIAC Web Application Penetration Tester (GWAPT), GIAC Certified Web Application Defender (GWEB), or comparable application security certification. * Offensive Security Web Expert (OSWE) or comparable advanced assessment certification. * AWS, Microsoft Azure, Google Cloud, Kubernetes, or DevSecOps certification relevant to the assigned environment. ## Description * Lead application security engineering activities across web applications, APIs, mobile applications, cloud-native services, containers, and supporting platforms. * Embed security controls throughout the software development lifecycle (SDLC), including requirements, architecture, design, development, build, test, release, and post-production monitoring. * Design, implement, tune, and govern automated security testing in CI/CD pipelines, including static application security testing (SAST), dynamic application security testing (DAST), interactive application security testing (IAST), software composition analysis (SCA), secrets detection, infrastructure-as-code scanning, container image scanning, API security testing, and mobile application testing. * Develop reusable automation, integrations, and security-as-code using Python, PowerShell, JavaScript, shell scripting, APIs, webhooks, and pipeline platforms to reduce manual effort and improve control coverage. * Build automated workflows that normalize, correlate, enrich, deduplicate, prioritize, ticket, route, retest, and close application vulnerability findings across security tools and engineering systems. * Leverage AI-assisted application vulnerability analysis to summarize evidence, identify code-to-vulnerability relationships, propose test cases, prioritize likely exploit paths, explain findings to developers, and draft remediation guidance. * Perform manual and tool-assisted application and API security assessments, validate exploitability, eliminate false positives, create proof-of-concept evidence when appropriate, and provide clear, actionable remediation guidance. * Lead application threat modeling and architecture risk reviews using practical methods such as abuse cases, data-flow analysis, trust-boundary analysis, and attack-path modeling. * Partner with software engineers, architects, product owners, DevOps/platform teams, cloud teams, and risk stakeholders to translate security requirements into pragmatic engineering solutions. * Develop and maintain secure coding standards, reusable security patterns, guardrails, reference implementations, and developer enablement materials aligned with OWASP guidance and recognized industry practices. * Serve as a technical escalation point for complex application vulnerabilities and major cybersecurity incidents; participate in an on-call rotation as required. * Mentor application security engineers and developers, contribute to technical strategy and roadmaps, and remain current with emerging attack techniques, defensive technologies, and AI-enabled software development risks.