Senior AppSec Engineer — Cloud-Native Security Architect

International Business Machines Corporation; Armonk (NY); On-site; USD 180,000 - 300,000; Full time

Job summary

IBM Software seeks a Staff Application Security Engineer to shape security across on-prem and cloud services. You will partner with engineering and product teams to embed security by design, drive threat modeling, and advance automation across large-scale systems.

The role emphasizes architecture, secure code reviews, and proactive risk management, with hands-on experience in Go, Python, or Java, and a track record of reducing vulnerabilities through scalable tooling and secure DevOps practices.

Qualifications

• 10+ years of hands-on application security experience.
• Experience with modern web apps and cloud-native platforms.
• Ability to partner with engineering and product leadership.
• Experience securing CI/CD pipelines and cloud-native deployment.
• Experience leading security reviews in distributed environments.

Responsibilities

• Identify security risks early and influence architectural decisions.
• Define threat modeling frameworks and security design standards.
• Lead security design reviews for complex distributed systems.
• Oversee security code reviews and API security testing.
• Architect security automation and tooling for scalable operations.
• Design deployment of automation in cloud-native deployment pipelines.
• Identify new vulnerability classes and lead research initiatives.

Skills

Application security

Security architecture

Secure coding practices

CI/CD security

Go/Python/Java

Distributed systems security

Threat modeling

Security reviews

Automation tooling

Education

Master's Degree

Job description

IBM Software seeks a Staff Application Security Engineer to shape security across on-prem and cloud services. You will partner with engineering and product teams to embed security by design, drive threat modeling, and advance automation across large-scale systems.

The role emphasizes architecture, secure code reviews, and proactive risk management, with hands-on experience in Go, Python, or Java, and a track record of reducing vulnerabilities through scalable tooling and secure DevOps practices.