Senior Staff Application Security Engineer

IBM Computing; Atlanta (GA); On-site; USD 160,000 - 230,000; Full time

Job summary

IBM is seeking a Staff Application Security Engineer to shape security across our on‑prem and cloud services. You will lead security architecture, threat modeling, and automation initiatives, partnering with Engineering and Product leadership to embed security by design throughout the lifecycle.

The role emphasizes scaling security operations through tooling, reviews, and proactive risk management, with a focus on high‑scale, distributed environments and AI/LLM‑driven security improvements.

Qualifications

• 10+ years of hands-on application security experience in large-scale distributed systems.
• Knowledge of secure software design and cloud-native platforms.
• Ability to embed security into core architecture and partner with leadership.

Responsibilities

• Define and evolve application security architecture across on‑prem and cloud platforms.
• Lead security design reviews for complex distributed systems.
• Oversee security code reviews, API security testing, and remediation guidance.
• Architect and drive security automation to scale security operations.
• Design deployment automation and orchestration for secure cloud-native pipelines.
• Lead vulnerability research and table-top exercises to stay ahead of threats.
• Deploy advanced controls to maximize observability and harden attack surfaces.

Skills

Security architecture

Threat modeling

Security automation

Cross-functional leadership

Cloud security

Security by design

Security strategy

Tools

Go

Python

Java

CI/CD pipelines

APIs security testing

Job description

IBM is seeking a Staff Application Security Engineer to shape security across our on‑prem and cloud services. You will lead security architecture, threat modeling, and automation initiatives, partnering with Engineering and Product leadership to embed security by design throughout the lifecycle.

The role emphasizes scaling security operations through tooling, reviews, and proactive risk management, with a focus on high‑scale, distributed environments and AI/LLM‑driven security improvements.