Application Security Engineer

About the role

The Schwab Application Security team is part of Cybersecurity Services and focuses on protecting Schwab's information assets. Key responsibilities include establishing and evolving Schwab's Secure Software Development Program, leading software security policies and practices, and collaborating with development teams to enhance security.

Responsibilities

• Create and implement software security policies and best practices
• Provide security architecture guidance
• Conduct software security scanning and penetration testing
• Train developers and testers on secure coding practices
• Partner with development teams to balance security and innovation
• Interpret large volumes of distributed data and translate into clear, actionable insights
• Work with a range of application security tools, including SCA, SAST, and secrets management solutions
• Design and implement reusable and scalable CI/CD workflows using GitHub Actions
• Architect centralized configuration and workflow distribution models for large repository ecosystems
• Manage internal package ecosystems and enforce dependency governance
• Develop and maintain technical documentation and architecture decision records

Requirements

• Prior engineering experience within a Software Security Assurance or Application Security team
• Proven ability to partner effectively with development teams
• Strong analytical skills, including the ability to interpret large volumes of distributed data
• Experience working with a range of application security tools
• Solid application engineering experience
• Strong understanding of common application vulnerabilities, attack vectors, and remediation strategies
• Familiarity with secure software design principles and industry best practices
• Experience with application security testing tools, such as Fortify
• Familiarity with recognized industry frameworks and standards such as OWASP, CIS, and NIST
• Minimum of two years of experience working with static analysis or threat modeling tools
• Experience implementing and scaling enterprise application security tools, services, and controls
• Strong understanding of secure coding practices, code review processes, threat modeling, security requirements analysis, and architectural risk assessment

Qualifications

• Minimum of two years of experience working with static analysis or threat modeling tools
• Experience with application security testing tools, such as Fortify
• Familiarity with recognized industry frameworks and standards such as OWASP, CIS, and NIST
• Strong understanding of secure coding practices, code review processes, threat modeling, security requirements analysis, and architectural risk assessment
• Experience with application security testing tools, such as Fortify
• Familiarity with recognized industry frameworks and standards such as OWASP, CIS, and NIST
• Strong understanding of secure coding practices, code review processes, threat modeling, security requirements analysis, and architectural risk assessment

Skills

• Python Automation & API Integration
• Custom CodeQL Query Development
• GitHub Advanced Security (GHAS) Platform Engineering
• CI/CD Pipeline Architecture (GitHub Actions)
• SARIF Output Analysis & Interpretation
• Enterprise Git Workflow & Release Management
• Application Security Vulnerability Engineering
• Multi-Repository Architecture & Configuration Delivery
• Enterprise Package Registry & Dependency Governance
• Technical Documentation & Architecture Decision Records

Benefits

At Schwab, we offer a competitive benefits package that includes:

• 401(k) with company match and Employee stock purchase plan
• Paid time off for vacation, volunteering, and 28-day sabbatical after every 5 years of service
• Paid parental leave and family building benefits
• Tuition reimbursement
• Health, dental, and vision insurance

Pay

Details about pay are not specified in this posting.

Schedule

Details about the schedule are not specified in this posting.