Security Engineer IV - Application Security

A hands-on practitioner who reduces application and software supply chain risk across the SDLC. Partners with engineering teams to turn security standards and findings into practical controls in code, CI/CD, and production, while building reusable automation that preserves developer flow and audit readiness.

What You’ll Do:

• Provide security guidance for web applications, APIs, cloud-native services, and agent-enabled workflows.

• Maintain secure coding patterns and controls aligned to OWASP ASVS, NIST SSDF, and internal SDLC standards.

• Engineer scalable SAST, SCA, secret, IaC, DAST, API, and container/artifact controls.

• Integrate risk-based checks into GitHub and CI/CD workflows with clear pass, warn, exception, and escalation behavior.

• Tune findings by exploitability, reachability, and asset criticality; automate Jira work items, evidence capture, and policy-as-code.

• Partner with platform teams on JFrog Curation, provenance, signed builds, and SLSA-aligned controls.

• Triage complex vulnerabilities, guide secure fixes, and verify remediation through retesting and automated evidence.

• Coordinate penetration testing, track accepted risks, and drive systemic prevention of recurring defects.

• Act as a senior partner to engineers, architects, product owners, DevSecOps, cloud security, and risk teams.

• Mentor engineers and security champions; lead exception and risk discussions with accountable owners.

Experience securing web applications, APIs, microservices, and cloud-native systems, with deep knowledge of OWASP Top 10 and API Security Top 10.

Hands-on secure code review, vulnerability triage, and operating or integrating SAST, SCA, DAST, secret, IaC, container, and API security tools.

Working knowledge of IAM, OAuth 2.0, OpenID Connect, TLS, secrets management, and secure logging.

Ability to execute independently from discovery to verified closure and to communicate technical risk clearly to engineering and risk stakeholders.

Proficiency in a language such as Python, Java, JavaScript/TypeScript, C#, or Go to review code and automate controls.

Experience with GitHub Actions and CI/CD workflows, including automated security checks, artifact repositories, and cloud or container platforms.

Ability to build reliable policy-as-code, integrations, and evidence workflows; understanding of SBOMs, provenance, signing, and SLSA.

Experience using AI-assisted development tools and assessing security risks in AI-generated code and AI-enabled workflows.

What Could Set You Apart?

Regulated-industry experience (financial services, healthcare); familiarity with NIST SSDF, NIST CSF, OWASP SAMM/ASVS, ISO 27001, CIS Controls, SLSA, and FINOS controls.

Experience with GitHub Advanced Security, Jira, Confluence, JFrog, Dynatrace, or Traceable.

Knowledge of AI application risks such as prompt injection, sensitive-data exposure, and excessive agency.

Certifications such as CSSLP, CISSP, GWEB, GWAPT, OSWE, or cloud security credentials are beneficial, not required.

Join a financial services firm where your contributions are valued. Edward Jones is a Fortune 500¹ company where people come first. With over 9 million clients and 20,000 financial advisors across the U.S. and Canada, we’re proud to be privately-owned, placing the focus on our clients rather than shareholder returns.

Behind everything we do is our purpose: We partner for positive impact to improve the lives of our clients and colleagues, and together, better our communities and society. We are an innovative, flexible, and inclusive organization that attracts, develops, and inspires performance excellence and a sense of belonging.

People are at the center of our partnership. Edward Jones associates are seen, heard, respected, and supported. This is what we believe makes us the best place to start or build your career.

View our Purpose, Inclusion and Citizenship Report (https://careers.edwardjones.com/blog/edward-jones-releases-annual-purpose-inclusion-and-citizenship-report/?codes=DIRECT&utm_source=DIRECT) .

¹Fortune 500, published June 2024, data as of December 2023. Compensation provided for using, not obtaining, the rating., At Edward Jones, we are building a place where everyone feels like they belong. We’re proud of our associates’ contributions to the firm and the recognitions we have received.