> Markdown version of [/jobs/ext/4689189-security-engineer-iv-application-security](https://www.wearedevelopers.com/jobs/ext/4689189-security-engineer-iv-application-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Engineer IV - Application Security - **Company:** Edward D. Jones & Co., L.P. - **Location:** Tempe, AZ, United States - **Contract:** Permanent contract - **Skills:** Java (Programming Language), JavaScript (Programming Language), Application Programming Interfaces (APIs), Artificial Intelligence, Software System Penetration Testing, Confluence, JIRA, C Sharp (Programming Language), Cloud Computing, Cloud Computing Security, Code Generation, Code Review, Continuous Integration, Github, Identity and Access Management, Python (Programming Language), Key Management, OAuth, Open Web Application Security, Systems Development Life Cycle, Openid Connect, Secure Coding, Security Software, TypeScript, Web Applications, Data Logging, Transport Layer Security, Software Security, National Institute of Standards and Technology Cybersecurity Framework, GWAPT, Containerization, CIS Benchmarks, Dynatrace, Devsecops, Serverless Computing, Static Application Security Testing, Microservices, Dynamic Application Security Testing - **Published:** November 12, 2026 - **Apply:** https://dejobs.org/x/x/B856E6E551E340C2B5E460560BEF1F8E/job/ ## About the Role Experience securing web applications, APIs, microservices, and cloud-native systems, with deep knowledge of OWASP Top 10 and API Security Top 10. Hands-on secure code review, vulnerability triage, and operating or integrating SAST, SCA, DAST, secret, IaC, container, and API security tools. Working knowledge of IAM, OAuth 2.0, OpenID Connect, TLS, secrets management, and secure logging. Ability to execute independently from discovery to verified closure and to communicate technical risk clearly to engineering and risk stakeholders. Proficiency in a language such as Python, Java, JavaScript/TypeScript, C#, or Go to review code and automate controls. Experience with GitHub Actions and CI/CD workflows, including automated security checks, artifact repositories, and cloud or container platforms. Ability to build reliable policy-as-code, integrations, and evidence workflows; understanding of SBOMs, provenance, signing, and SLSA. Experience using AI-assisted development tools and assessing security risks in AI-generated code and AI-enabled workflows. What Could Set You Apart? Regulated-industry experience (financial services, healthcare); familiarity with NIST SSDF, NIST CSF, OWASP SAMM/ASVS, ISO 27001, CIS Controls, SLSA, and FINOS controls. Experience with GitHub Advanced Security, Jira, Confluence, JFrog, Dynatrace, or Traceable. Knowledge of AI application risks such as prompt injection, sensitive-data exposure, and excessive agency. Certifications such as CSSLP, CISSP, GWEB, GWAPT, OSWE, or cloud security credentials are beneficial, not required. ## Description A hands-on practitioner who reduces application and software supply chain risk across the SDLC. Partners with engineering teams to turn security standards and findings into practical controls in code, CI/CD, and production, while building reusable automation that preserves developer flow and audit readiness. What You'll Do: * Provide security guidance for web applications, APIs, cloud-native services, and agent-enabled workflows. * Maintain secure coding patterns and controls aligned to OWASP ASVS, NIST SSDF, and internal SDLC standards. * Engineer scalable SAST, SCA, secret, IaC, DAST, API, and container/artifact controls. * Integrate risk-based checks into GitHub and CI/CD workflows with clear pass, warn, exception, and escalation behavior. * Tune findings by exploitability, reachability, and asset criticality; automate Jira work items, evidence capture, and policy-as-code. * Partner with platform teams on JFrog Curation, provenance, signed builds, and SLSA-aligned controls. * Triage complex vulnerabilities, guide secure fixes, and verify remediation through retesting and automated evidence. * Coordinate penetration testing, track accepted risks, and drive systemic prevention of recurring defects. * Act as a senior partner to engineers, architects, product owners, DevSecOps, cloud security, and risk teams. * Mentor engineers and security champions; lead exception and risk discussions with accountable owners.