Senior App Security Engineer — DevSecOps & SDLC Expert

FHLB Des Moines; Des Moines, Northern (IA, KY); Hybrid; USD 102,000 - 121,000; Full time

Job summary

FHLB Des Moines seeks an Application Security Engineer II to serve as the technical SME for application security, partnering with software teams to embed security across the SDLC. You will conduct security assessments, design reviews, DevSecOps initiatives, and vulnerability management to protect information assets and regulatory compliance.

You will administer code and pipeline security tooling, secure IaC deployments, and integrate automated security into CI/CD workflows while guiding

Qualifications

• 3-5 years of experience in Application Security or related field.
• Experience performing application security assessments and validating remediation.
• Experience with SDLC security tooling and code reviews.
• Familiarity with OWASP Top 10 and secure authentication principles.
• Strong communication and ability to explain security risks to non-security partners.

Responsibilities

• Administer code and pipeline security tooling (SAST, DAST, SCA, etc.).
• Maintain and enhance secure code training program.
• Provide security guidance for repositories and pipelines.
• Integrate security controls into CI/CD pipelines and developer workflows.
• Collaborate with stakeholders to prioritize high-risk issues and drive remediation.
• Support secure design reviews and architecture risk assessments.
• Develop scripts or tooling to improve security processes and automated scans.

Skills

Application Security

SDLC Security

DevSecOps

Threat Modeling

Secure Coding Practices

Vulnerability Management

CI/CD Security

Education

Bachelor's in Computer Science

Tools

SAST tooling

DAST tooling

SCA tooling

Container security tooling

Infrastructure as Code tooling

Git

CI/CD tooling

Job description

FHLB Des Moines seeks an Application Security Engineer II to serve as the technical SME for application security, partnering with software teams to embed security across the SDLC. You will conduct security assessments, design reviews, DevSecOps initiatives, and vulnerability management to protect information assets and regulatory compliance.

You will administer code and pipeline security tooling, secure IaC deployments, and integrate automated security into CI/CD workflows while guiding