Application Security Architect

Edward Jones; St. Louis (MO); Hybrid; USD 150,000 - 230,000; Full time

Benefits offered by this job

Medical and prescription drug coverage

Dental coverage

Vision coverage

401(k) retirement plan

Paid holidays and vacation

Job summary

Edward Jones is seeking an experienced Application Security Architect to build and maintain a CI/CD‑integrated AI evaluation harness for security of source code and SDLC processes. This hands‑on IC role combines AppSec, DevSecOps, AI engineering, and governance across financial services compliance.

The ideal candidate has 10+ years in security architecture, secure code review, and AI‑enabled code review methods, with strong knowledge of OWASP, NIST, and governance frameworks.

Qualifications

• Bachelor’s degree in CS, cybersecurity, software engineering, IT, engineering, or related field.
• 10+ years of experience in application security, secure software engineering, DevSecOps, security architecture, or related cybersecurity roles.
• Deep expertise in secure code review, vulnerability detection, threat modeling, exploitability analysis, and secure SDLC practices.
• Experience with vulnerability and penetration test readouts/walkthroughs with stakeholders.
• Hands-on experience with SAST, SCA, DAST, secrets scanning, API security testing, container security, IaC scanning, and developer workflow integrations.
• Experience integrating security capabilities into SDLC pipeline tooling: Jenkins, GitHub Actions, GitHub Enterprise, Atlassian, developer portals, source‑control workflows, and DevSecOps toolchains.
• Practical experience using LLMs or AI models for code review, software engineering, vulnerability research, security analysis, or developer productivity use cases.
• Understanding of prompt engineering and optimization, RAG, model evaluation, AI guardrails, human‑in‑the‑loop review, prompt/model versioning, and vendor/open‑source model trade‑offs.
• Experience designing or maintaining evaluation harnesses, benchmark suites, regression tests, validation pipelines, and test orchestration workflows.
• Strong understanding of OWASP, CWE, CVSS, NIST SSDF, AI security risks, regulated source‑code handling, auditability, and vendor/model governance.

Responsibilities

• Architect the CI/CD‑integrated AI secure‑code evaluation harness as a hands‑on IC for source code repositories and Secure SDLC lifecycles.
• Integrate evaluation workflows with pipeline tooling and AppSec reporting platforms.
• Design AI‑assisted secure code review methods that complement SAST, SCA, DAST, secrets scanning, IaC scanning, threat modeling, security testing, and manual assessments.
• Maintain benchmarks, golden test cases, prompt/model versions, retrieval configurations, scoring criteria, and regression tests for AI‑generated findings.
• Govern approved vendor and frontier AI models, including selection, routing, fallback patterns, accuracy, explainability, cost, and data‑protection trade‑offs.
• Define safeguards for proprietary production code, including access controls, approved model endpoints, minimization, retention limits, secure logging, and evidence handling.
• Route validated findings into developer workflows with actionable remediation guidance and feedback loops to reduce false positives and improve adoption.
• Define metrics and control evidence aligned to internal governance processes, financial services industries authorities, and cyber security frameworks (NIST SSDF, NIST CSF 2.0, NYDFS, FINRA, SOX ITGC, FFIEC, GLBA).

Skills

Application security

DevSecOps

Secure SDLC

Threat modeling

SAST

SCA

DAST

Vulnerability assessment

AI governance

LLMs for code review

Education

Bachelor’s degree in Computer Science, Cybersecurity, Software Engineering, Information Technology, Engineering, or related field

Tools

Jenkins

GitHub Actions

GitHub Enterprise

Atlassian

Job description

Join a financial services firm where your contributions are valued. Edward Jones is a Fortune 500¹ company where people come first. With over 9 million clients and 20,000 financial advisors across the U.S. and Canada, we’re proud to be privately-owned, placing the focus on our clients rather than shareholder returns.

Behind everything we do is our purpose: We partner for positive impact to improve the lives of our clients and colleagues, and together, better our communities and society. We are an innovative, flexible, and inclusive organization that attracts, develops, and inspires performance excellence and a sense of belonging.

People are at the center of our partnership. Edward Jones associates are seen, heard, respected, and supported. This is what we believe makes us the best place to start or build your career.

View our Purpose, Inclusion and Citizenship Report.

¹Fortune 500, published June 2024, data as of December 2023. Compensation provided for using, not obtaining, the rating.

Team Overview:

The Application Security Architect, Agentic Secure Code Architect is a hands‑on architecture‑focused IC responsible for designing, integrating, maintaining, and improving a CI/CD‑integrated AI evaluation harness used to assess application and infrastructure source code for security vulnerabilities and insecure‑design practices. This role combines AppSec, DevSecOps, AI engineering, secure SDLC governance, and financial‑services compliance, with strong emphasis on source‑code protection, enterprise controls governance, repeatability, auditability, measurable risk reduction, and developer trust.

What You'll Do:

• Architect the CI/CD‑integrated AI secure‑code evaluation harness as a hands‑on IC for source code repositories and Secure SDLC lifecycles.
• Integrate evaluation workflows with pipeline tooling and AppSec reporting platforms.
• Design AI‑assisted secure code review methods that complement SAST, SCA, DAST, secrets scanning, IaC scanning, threat modeling, security testing, and manual assessments.
• Maintain benchmarks, golden test cases, prompt/model versions, retrieval configurations, scoring criteria, and regression tests for AI‑generated findings.
• Govern approved vendor and frontier AI models, including selection, routing, fallback patterns, accuracy, explainability, cost, and data‑protection trade‑offs.
• Define safeguards for proprietary production code, including access controls, approved model endpoints, minimization, retention limits, secure logging, and evidence handling.
• Route validated findings into developer workflows with actionable remediation guidance and feedback loops to reduce false positives and improve adoption.
• Define metrics and control evidence aligned to internal governance processes, financial services industries authorities, and cyber security frameworks (NIST SSDF, NIST CSF 2.0, NYDFS, FINRA, SOX ITGC, FFIEC, GLBA).

What Experience You'll Need:

• Bachelor’s degree in Computer Science, Cybersecurity, Software Engineering, Information Technology, Engineering, or related field.
• 10+ years of experience in application security, secure software engineering, DevSecOps, security architecture, or related cybersecurity roles.
• Deep expertise in secure code review, vulnerability detection, threat modeling, exploitability analysis, and secure SDLC practices.
• Experience with performing vulnerability and penetration test readouts/walkthroughs with stakeholders.
• Hands‑on experience with SAST, SCA, DAST, secrets scanning, API security testing, container security, infrastructure‑as‑code scanning, and developer workflow integrations.
• Experience integrating security capabilities into SDLC pipeline tooling: Jenkins, GitHub Actions, GitHub Enterprise, Atlassian, developer portals, source‑control workflows, and DevSecOps toolchains.
• Practical experience using LLMs or AI models for code review, software engineering, vulnerability research, security analysis, or developer productivity use cases.
• Understanding of prompt engineering and optimization, RAG, model evaluation, AI guardrails, human‑in‑the‑loop review, prompt/model versioning, and vendor/open‑source model trade‑offs.
• Experience designing or maintaining evaluation harnesses, benchmark suites, regression tests, validation pipelines, and test orchestration workflows.
• Strong understanding of concepts: OWASP, CWE, CVSS, NIST SSDF, AI security risks, regulated source‑code handling, auditability, and vendor/model governance.

What Could Set You Apart:

• Master’s degree or relevant certifications such as CISSP, CSSLP, OSWE, GWAPT, CCSP, cloud security, Kubernetes security, or AI governance certifications.
• Experience delivering AI‑assisted AppSec capabilities in a Fortune 500 or highly regulated financial services environment.
• Hands‑on experience with enterprise AI platforms, approved vendor models, open‑source models, secure hosting, RAG, and AI governance controls.
• Experience building secure code review automation, custom static analysis rules, vulnerability detection pipelines, benchmark datasets, or AI‑based developer tooling.
• Demonstrated success reducing AppSec risk through improved detection accuracy, lower false positives, faster remediation, and stronger developer enablement.

Candidates that live within a commutable distance from our Tempe, AZ and St. Louis, MO home office locations are expected to work in the office four days per week effective June 1, 2026. Before June 1, 2026, candidates that live within a commutable distance from our Tempe, AZ and St. Louis, MO home office locations are expected to work in the office three days per week, with preference for Tuesday through Thursday.

At Edward Jones, we are building a place where everyone feels like they belong. We're proud of our associates' contributions to the firm and the recognitions we have received.

Check out our U.S. awards and accolades: Insights & Information Blog Postings about Edward Jones

Check out our Canadian awards and accolades: Insights & Information Blog Postings about Edward Jones

Edward Jones does not discriminate on the basis of race, color, gender, religion, national origin, age, disability, sexual orientation, pregnancy, veteran status, genetic information or any other basis prohibited by applicable law.

Edward Jones' compensation and benefits package includes medical and prescription drug, dental, vision, voluntary benefits (such as accident, hospital indemnity, and critical illness), short- and long-term disability, basic life, and basic AD&D coverage. Short- and long-term disability, basic life, and basic AD&D coverage are provided at no cost to associates. Edward Jones offers a 401k retirement plan, and tax-advantaged accounts: health savings account, and flexible spending account. Edward Jones observes ten paid holidays and provides 15 days of vacation for new associates beginning on January 1 of each year, as well as sick time, personal days, and a paid day for volunteerism. Associates may be eligible for bonuses and profit sharing. All associates are eligible for the firm's Employee Assistance Program. For more information on the Benefits available to Edward Jones associates, please visit our benefits page.