AI-Powered Secure Code Reviewer for Applications

Vanguard; Dallas (TX); Hybrid; USD 110,000 - 150,000; Full time

Job summary

Vanguard seeks a Secure Code Reviewer to join the Threat Modeling & Validation team. The role analyzes source code using manual and AI-assisted methods to identify vulnerabilities and insecure practices, then guides remediation with developers.

You'll validate findings, produce technical reports, and collaborate with security and development teams to strengthen our SDLC in a hybrid work setup.

Qualifications

• Minimum 3 years in application security, secure code review, or security-focused software engineering.
• Knowledge of secure coding practices and common vulnerabilities (OWASP Top 10).
• Familiarity with modern architectures, APIs, cloud-native apps, and CI/CD.
• Experience with Java, C#, Python, JavaScript/TypeScript, Go or similar.
• Experience with SAST tools such as Checkmarx, Fortify, Veracode, Semgrep, or SonarQube.
• Understanding of secure SDLC and DevSecOps.

Responsibilities

• Performs manual and AI-assisted secure code reviews across modern application stacks.
• Identifies vulnerabilities, logic flaws, and insecure coding practices.
• Reviews and validates findings from automated and AI-assisted analysis.
• Produces clear technical reports and risk-based remediation recommendations.
• Collaborates with development teams to communicate findings and support remediation.
• Works with penetration testers, threat modelers, and security teams.
• Supports team processes, methodologies, and automation initiatives.

Skills

Application security

Secure code review

Software engineering

OWASP Top 10

CI/CD pipelines

SAST tools

AI-assisted tools

Communication skills

Education

Undergraduate degree or equivalent

Tools

Checkmarx

Fortify

Veracode

Semgrep

SonarQube

Job description

Vanguard seeks a Secure Code Reviewer to join the Threat Modeling & Validation team. The role analyzes source code using manual and AI-assisted methods to identify vulnerabilities and insecure practices, then guides remediation with developers.

You'll validate findings, produce technical reports, and collaborate with security and development teams to strengthen our SDLC in a hybrid work setup.