Opportunity OverviewOverview:A hands-on practitioner who reduces application and software supply chain risk across the SDLC. Partners with engineering teams to turn security standards and findings into practical controls in code, CI/CD, and production, while building reusable automation that preserves developer flow and audit readiness.
What You'll Do:• Provide security guidance for web applications, APIs, cloud-native services, and agent-enabled workflows.
• Maintain secure coding patterns and controls aligned to OWASP ASVS, NIST SSDF, and internal SDLC standards.
• Engineer scalable SAST, SCA, secret, IaC, DAST, API, and container/artifact controls.
• Integrate risk-based checks into GitHub and CI/CD workflows with clear pass, warn, exception, and escalation behavior.
• Tune findings by exploitability, reachability, and asset criticality; automate Jira work items, evidence capture, and policy-as-code.
• Partner with platform teams on JFrog Curation, provenance, signed builds, and SLSA-aligned controls.
• Triage complex vulnerabilities, guide secure fixes, and verify remediation through retesting and automated evidence.
• Coordinate penetration testing, track accepted risks, and drive systemic prevention of recurring defects.
• Act as a senior partner to engineers, architects, product owners, DevSecOps, cloud security, and risk teams.
• Mentor engineers and security champions; lead exception and risk discussions with accountable owners.
Position RequirementsWhat Experience You'll Need- Experience securing web applications, APIs, microservices, and cloud-native systems, with deep knowledge of OWASP Top 10 and API Security Top 10.
- Hands-on secure code review, vulnerability triage, and operating or integrating SAST, SCA, DAST, secret, IaC, container, and API security tools.
- Working knowledge of IAM, OAuth 2.0, OpenID Connect, TLS, secrets management, and secure logging.
- Ability to execute independently from discovery to verified closure and to communicate technical risk clearly to engineering and risk stakeholders.
- Proficiency in a language such as Python, Java, JavaScript/TypeScript, C#, or Go to review code and automate controls.
- Experience with GitHub Actions and CI/CD workflows, including automated security checks, artifact repositories, and cloud or container platforms.
- Ability to build reliable policy-as-code, integrations, and evidence workflows; understanding of SBOMs, provenance, signing, and SLSA.
- Experience using AI-assisted development tools and assessing security risks in AI-generated code and AI-enabled workflows.
What Could Set You Apart?- Regulated-industry experience (financial services, healthcare); familiarity with NIST SSDF, NIST CSF, OWASP SAMM/ASVS, ISO 27001, CIS Controls, SLSA, and FINOS controls.
- Experience with GitHub Advanced Security, Jira, Confluence, JFrog, Dynatrace, or Traceable.
- Knowledge of AI application risks such as prompt injection, sensitive-data exposure, and excessive agency.
- Certifications such as CSSLP, CISSP, GWEB, GWAPT, OSWE, or cloud security credentials are beneficial, not required.
**Candidates that live within a commutable distance from our Tempe, AZ and St. Louis, MO home office locations are expected to work in the office four days per week effective June 1, 2026. Before June 1, 2026, candidates that live within a commutable distance from our Tempe, AZ and St. Louis, MO home office locations are expected to work in the office three days per week, with preference for Tuesday through Thursday.** Salary InformationEdward Jones' compensation and benefits package includes medical and prescription drug, dental, vision, voluntary benefits (such as accident, hospital indemnity, and critical illness), short- and long-term disability, basic life, and basic AD&D coverage. Short- and long-term disability, basic life, and basic AD&D coverage are provided at no cost to associates. Edward Jones offers a 401k retirement plan, and tax-advantaged accounts: health savings account, and flexible spending account. Edward Jones observes ten paid holidays and provides 15 days of vacation for new associates beginning on January 1 of each year, as well as sick time, personal days, and a paid day for volunteerism. Associates may be eligible for bonuses and profit sharing. All associates are eligible for the firm's Employee Assistance Program. For more information on the Benefits available to Edward Jones associates, please visit our benefits page.
