AI-Driven Application Security Architect

Edward Jones; St. Louis (MO); Hybrid; USD 150,000 - 230,000; Full time

Benefits offered by this job

Medical and prescription drug coverage

Dental coverage

Vision coverage

401(k) retirement plan

Paid holidays and vacation

Job summary

Edward Jones is seeking an experienced Application Security Architect to build and maintain a CI/CD‑integrated AI evaluation harness for security of source code and SDLC processes. This hands‑on IC role combines AppSec, DevSecOps, AI engineering, and governance across financial services compliance.

The ideal candidate has 10+ years in security architecture, secure code review, and AI‑enabled code review methods, with strong knowledge of OWASP, NIST, and governance frameworks.

Qualifications

• Bachelor’s degree in CS, cybersecurity, software engineering, IT, engineering, or related field.
• 10+ years of experience in application security, secure software engineering, DevSecOps, security architecture, or related cybersecurity roles.
• Deep expertise in secure code review, vulnerability detection, threat modeling, exploitability analysis, and secure SDLC practices.
• Experience with vulnerability and penetration test readouts/walkthroughs with stakeholders.
• Hands-on experience with SAST, SCA, DAST, secrets scanning, API security testing, container security, IaC scanning, and developer workflow integrations.
• Experience integrating security capabilities into SDLC pipeline tooling: Jenkins, GitHub Actions, GitHub Enterprise, Atlassian, developer portals, source‑control workflows, and DevSecOps toolchains.
• Practical experience using LLMs or AI models for code review, software engineering, vulnerability research, security analysis, or developer productivity use cases.
• Understanding of prompt engineering and optimization, RAG, model evaluation, AI guardrails, human‑in‑the‑loop review, prompt/model versioning, and vendor/open‑source model trade‑offs.
• Experience designing or maintaining evaluation harnesses, benchmark suites, regression tests, validation pipelines, and test orchestration workflows.
• Strong understanding of OWASP, CWE, CVSS, NIST SSDF, AI security risks, regulated source‑code handling, auditability, and vendor/model governance.

Responsibilities

• Architect the CI/CD‑integrated AI secure‑code evaluation harness as a hands‑on IC for source code repositories and Secure SDLC lifecycles.
• Integrate evaluation workflows with pipeline tooling and AppSec reporting platforms.
• Design AI‑assisted secure code review methods that complement SAST, SCA, DAST, secrets scanning, IaC scanning, threat modeling, security testing, and manual assessments.
• Maintain benchmarks, golden test cases, prompt/model versions, retrieval configurations, scoring criteria, and regression tests for AI‑generated findings.
• Govern approved vendor and frontier AI models, including selection, routing, fallback patterns, accuracy, explainability, cost, and data‑protection trade‑offs.
• Define safeguards for proprietary production code, including access controls, approved model endpoints, minimization, retention limits, secure logging, and evidence handling.
• Route validated findings into developer workflows with actionable remediation guidance and feedback loops to reduce false positives and improve adoption.
• Define metrics and control evidence aligned to internal governance processes, financial services industries authorities, and cyber security frameworks (NIST SSDF, NIST CSF 2.0, NYDFS, FINRA, SOX ITGC, FFIEC, GLBA).

Skills

Application security

DevSecOps

Secure SDLC

Threat modeling

SAST

SCA

DAST

Vulnerability assessment

AI governance

LLMs for code review

Education

Bachelor’s degree in Computer Science, Cybersecurity, Software Engineering, Information Technology, Engineering, or related field

Tools

Jenkins

GitHub Actions

GitHub Enterprise

Atlassian

Job description

Edward Jones is seeking an experienced Application Security Architect to build and maintain a CI/CD‑integrated AI evaluation harness for security of source code and SDLC processes. This hands‑on IC role combines AppSec, DevSecOps, AI engineering, and governance across financial services compliance.

The ideal candidate has 10+ years in security architecture, secure code review, and AI‑enabled code review methods, with strong knowledge of OWASP, NIST, and governance frameworks.