AI-Driven AppSec Architect: Secure SDLC & DevSecOps

Edward Jones

Tempe (AZ)

Hybrid

USD 150,000 - 190,000

Full time

21 hours ago

Be an early applicant

Get more replies from employers

Send a job-specific resume in minutes.

Benefits offered by this job

Medical benefits

Dental & vision

401k plan

Paid time off

Job summary

Edward Jones is seeking an experienced Application Security Architect to design and implement a CI/CD‑integrated AI evaluation harness for secure software delivery in financial services. This hands‑on IC role blends AppSec, DevSecOps, AI engineering, and governance to reduce risk while enabling developers across our Tempe, AZ location and partner offices.

The role involves defining security controls, mentoring teams, and ensuring compliance with NIST, FINRA, SOX, and related frameworks to

Qualifications

Bachelor’s degree in Computer Science, Cybersecurity, Software Engineering, Information Technology, Engineering, or related field.
10+ years of experience in application security, secure software engineering, DevSecOps, security architecture, or related cybersecurity roles.
Deep expertise in secure code review, vulnerability detection, threat modeling, exploitability analysis, and secure SDLC practices.
Experience with vulnerability and penetration test readouts/walkthroughs with stakeholders.
Hands-on experience with SAST, SCA, DAST, secrets scanning, API security testing, container security, IaC scanning, and dev‑workflow integrations.
Experience integrating security capabilities into SDLC pipeline tooling: Jenkins, GitHub Actions, GitHub Enterprise, Atlassian, developer portals, source-control workflows, and DevSecOps toolchains.
Practical experience using LLMs or AI models for code review, software engineering, vulnerability research, security analysis, or developer productivity use cases.
Understanding of prompt engineering and optimization, RAG, model evaluation, AI guardrails, human‑in‑the‑loop review, prompt/model versioning, and vendor/open‑source model trade‑offs.
Experience designing or maintaining evaluation harnesses, benchmark suites, regression tests, validation pipelines, and test orchestration workflows.
Strong understanding of concepts: OWASP, CWE, CVSS, NIST SSDF, AI security risks, regulated source‑code handling, auditability, and vendor/model governance.

Responsibilities

Architect the CI/CD‑integrated AI secure‑code evaluation harness as a hands‑on IC for source code repositories and Secure SDLC lifecycles.
Integrate evaluation workflows with pipeline tooling and AppSec reporting platforms.
Design AI‑assisted secure code review methods that complement SAST, SCA, DAST, secrets scanning, IaC scanning, threat modeling, security testing, and manual assessments.
Maintain benchmarks, golden test cases, prompt/model versions, retrieval configurations, scoring criteria, and regression tests for AI‑generated findings.
Govern approved vendor and frontier AI models, including selection, routing, fallback patterns, accuracy, explainability, cost, and data‑protection trade‑offs.
Define safeguards for proprietary production code, including access controls, approved model endpoints, minimization, retention limits, secure logging, and evidence handling.
Route validated findings into developer workflows with actionable remediation guidance and feedback loops to reduce false positives and improve adoption.
Define metrics and control evidence aligned to internal governance processes, financial services authorities, and cyber security frameworks (NIST SSDF, NIST CSF 2.0, NYDFS, FINRA, SOX ITGC, FFIEC, GLBA).