Senior DevSecOps & AI-Driven Application Security Engineer

East West Bank; San Marino (CA); On-site; USD 120,000 - 180,000; Full time

Job summary

East West Bank seeks a Senior Cyber Security Engineer to lead security initiatives across the application lifecycle, integrating security into DevOps and overseeing vulnerability management and testing across enterprise applications.

The role covers third-party software analysis, binary inspection, and secure software onboarding within a regulated banking environment. Strong collaboration with Dev teams and stakeholders is essential.

Qualifications

• Proven experience in application security, DevSecOps, or software security analysis.
• Strong hands-on expertise in SAST/DAST tools and secure SDLC practices.
• Experience with GitHub and open-source ecosystems; GitHub Advanced Security.

Responsibilities

• Embed security controls into CI/CD pipelines using GitHub workflows.
• Collaborate with development teams to implement secure coding practices and threat modeling.
• Manage GitHub Advanced Security configurations, including secret scanning and impact analysis.
• Conduct SAST/DAST and perform code reviews to identify vulnerabilities.
• Maintain mapping of applications to GitHub repositories for vulnerability tracking.
• Analyze third-party software including binary analysis where source is unavailable.
• Support software trust framework and secure onboarding decisions.
• Analyze open-source dependencies and contribution risk.
• Integrate threat intelligence into software risk assessments.
• Reassess software trust posture as threat conditions change.

Skills

SAST/DAST tools

Secure SDLC

GitHub & OSS

GitHub Advanced Security

Third-party software risk analysis

Software supply chain security

Threat intelligence integration

Threat modeling (STRIDE)

Penetration testing coordination

Stakeholder communication

Tools

CodeQL

OWASP ZAP

Dependabot

Job description

East West Bank seeks a Senior Cyber Security Engineer to lead security initiatives across the application lifecycle, integrating security into DevOps and overseeing vulnerability management and testing across enterprise applications.

The role covers third-party software analysis, binary inspection, and secure software onboarding within a regulated banking environment. Strong collaboration with Dev teams and stakeholders is essential.