> Markdown version of [/jobs/ext/4464303-lead-software-engineer-information-security](https://www.wearedevelopers.com/jobs/ext/4464303-lead-software-engineer-information-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Lead Software Engineer-Information Security - **Company:** Wells Fargo - **Location:** Chandler, AZ, United States - **Experience:** Expert - **Salary:** $119,000.0 - $206,000.0 - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Agile Methodology, Applications Architecture, JIRA, Microsoft Azure, Cloud Engineering, Control Objectives for Information and Related Technology (COBIT), Static Program Analysis, Cyber Security, Continuous Integration, DevOps, Github, Open Web Application Security, Fortify (Software), Secure Coding, Software Engineering, Software Vulnerability Management, Cloud Platform System, Software Security, GWAPT, Checkmarx, Devsecops, Static Application Security Testing, Microservices, Dynamic Application Security Testing - **Published:** October 12, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=ddc8e0b11692e2d2 ## About the Role * 5+ years of Software Engineering experience, or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, or education * 5+years of experience in Application Security, Secure Software Development, Product Security, or DevSecOps * Strong knowledge of secure software development practices and modern application architectures, including cloud-native platforms, microservices, and APIs * Experience performing secure code reviews and utilizing application security testing tools, including SAST, DAST, SCA, and GitHub Advanced Security (GHAS) * Experience implementing Secure Software Development Lifecycle (SSDLC) practices, threat modeling methodologies (e.g., STRIDE, PASTA), and OWASP security standards * Experience partnering with development teams to integrate security controls throughout the software development lifecycle. Desired Qualifications * 1+ year of experience with Fortify Code Analyzer and Checkmarx * 1+ year of experience with Black Duck Software Composition Analysis (SCA) * 1+ year of experience with Static Application Security Testing (SAST) tools * Experience working in Agile and DevOps environments utilizing tools such as GitHub, Jira, and Azure DevOps * Knowledge of regulatory, risk, and compliance frameworks including NIST, ISO 27001, and CRI Profile * Experience scaling application security programs across large, federated, or decentralized organizations * Industry-recognized application security certifications such as CSSLP, GWAPT, OSWE, or SANS/GIAC certifications (GSSP, GWEB, or equivalent).Strong ability to influence technical teams, manage competing priorities, and drive security outcomes without direct authority * Experience developing and delivering secure coding training, developer enablement programs, or application security awareness initiatives * Experience leading security initiatives within cloud-native and DevSecOps environments. * Demonstrated ability to build strong partnerships with engineering, architecture, risk, and technology teams to improve application security posture. Job Expectations: * Ability to work additional hours as needed * Meet in-office expectations (currently 3 days in-office per week average) * This position is not eligible for Visa sponsorship * Ability to manage highly complex issues and negotiate solutions * Ability to interact and communicate effectively with all levels of an organization; including at the executive level. Pay Range Reflected is the base pay range offered for this position. Pay may vary depending on factors including but not limited to demonstrated examples of prior performance, skills, experience, or work location. Employees may also be eligible for incentive opportunities. $119,000.00 - $206,000.00 ## Description Wells Fargo is seeking a Lead Software Engineer- Information Security. The Application Security Champion group is looking for a Lead Information Security professional with security knowledge to help with daily operations of the Application Security Champion (ASC) operating model. As a Core Application Security Champion (Core ASC), you'll play a pivotal leadership role in scaling our modern security program across thousands of global applications. You will serve as a subject matter expert (SME), supporting engineering teams and mentoring a growing network of Satellite ASCs embedded within development squads. This role is ideal for a passionate security professional who thrives at the intersection of secure development, enablement, and innovation. In this role, you will: * Provide deep technical guidance on secure coding, vulnerability remediation, threat modeling, and security tools * Serve as the escalation point for Satellite ASCs, ensuring QA/QC of findings, especially in high-risk and regulatory environments * Lead and continuously enhance the Satellite ASC enablement journey, including onboarding, advanced training, and mentorship * Participate in and lead secure design reviews, code analysis, and architecture consultations across multiple development teams * Drive and maintain automated security tooling integrations in CI/CD (e.g., SAST, SCA, secrets scanning, IaC reviews) * Support the creation and tracking of security KPIs and metrics dashboards, helping measure risk reduction and program impact * Help shape policy and control frameworks that balance developer velocity with security assurance * Contribute to the governance and continuous improvement of the Satellite ASC Program * Act as a senior advisor and technical lead for the Satellite ASC Program, helping define governance, oversight, and continuous improvement * Partner with Product, Engineering, and Risk leaders to define secure design patterns and control objectives for cloud and enterprise systems * Lead the review and escalation process for critical findings, ensuring alignment with enterprise risk tolerance * Coach and guide other Core ASCs to raise overall capability and impact of the Core ASC Center of Excellence.