Senior Information Security Engineer

We need to output only HTML fragment, no html/body tags, no markdown fences. Use

for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to include sections only when posting has real specific content. Let's parse the posting. Content: - About This Role: description: "Wells Fargo is seeking a Senior Information Security Engineer to join our Application Security Team." Then "In This Role, You Will" bullet list of duties. We need to separate sections: About the role (maybe heading "About the role") with prose. Responsibilities: list of duties from "In This Role, You Will" bullet points. Requirements: maybe "Required Qualifications" and "Desired Qualifications"? The spec says we can have Requirements, Qualifications, Skills sections. We need to decide. We have Required Qualifications (list) and Desired Qualifications (list). Also there are Job Expectations (hybrid schedule, visa not eligible, AI proficiency expectations). Also Salary Ranges (Pay). Benefits section. Schedule: hybrid work schedule mentioned. We need to avoid boilerplate: remove EEO, legal, etc. Also remove Posting End Date, etc. We need to preserve all substantive information. Let's extract: About the role: "Wells Fargo is seeking a Senior Information Security Engineer to join our Application Security Team." Responsibilities (bullet list): - Design and implement repeatable, scalable, and automated AppSec processes - Provide hands-on technical leadership in tooling integration, automation, and process execution - Implement ongoing product (internal and vendor) enhancements and fine-tuning of rules to increase the precision in identifying and prioritizing application security defects. - Manage upgrades, resiliency, continuity, and compliance with enterprise standards. - Recommend mitigation strategies for identified application security risks - Serve as an AppSec representative in cross-functional governance and technical forums - Support integration of AppSec controls across enterprise tools and CI/CD pipelines - Support reporting of AppSec processes, execution status, and outcomes - Collaborate with control management and cybersecurity leadership to design new security controls - Support internal and external audits, regulatory reviews, and third-party assessments Required Qualifications: - 4+ years of Information Security Engineering experience, or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education - Expertise across core Application Security domains SAST, DAST, SCA, Secrets management and detection, Infrastructure as Code (IaC) - Strong experience integrating SAST, DAST, and SCA tools into SDLC workflows and source code repositories - Advanced knowledge of GitHub, Jira, ServiceNow, Jenkins, Harness, and CI/CD ecosystems - Strong understanding of OWASP standards and MITRE CVE/CWE frameworks - Experience implementing and maturing Secure Software Development Lifecycle (SSDLC) practices across Agile and custom development frameworks - Familiarity with AI/LLM-enabled development tooling (e.g., Cursor, GitHub Copilot, custom LLM integrations), including auto-remediation capabilities using AI, and governance considerations Desired Qualifications: - 4 + years - Development experience in more than one language - 3 + years of using the IaC to configure, build, and deploy - 2+ years of DevSecOps / Automation experience - Hands-on experience with vendor tools Checkmarx, Blackduck, Prisma, Trufflehog, Synk, Socket, Invicti, Qualys - Proven experience with GitHub Advanced Security (GHAS), including secret scanning capabilities - Experience in API development and custom services Job Expectations: - This position offers a hybrid work schedule - This position is not eligible for Visa sponsorship - Demonstrate proficiency in using AI-assisted development and analysis tools (e.g., GitHub Copilot and approved code-centric agents) - Leverage AI to accelerate system design, coding, testing, analysis, and troubleshooting - Apply strong technical judgment when validating and integrating AI-assisted outputs into solutions - Understand and account for model limitations, security risks, and operational considerations - Apply AI responsibly in development and production environments - Ensure AI usage aligns with security, compliance, privacy, and ethical standards Salary Ranges: - $100,000 - $163,000 - Charlotte, NC - $100,000 - $163,000 - Chandler, AZ - $100,000 - $163,000- Irving, TX (note formatting) - $100,000 - $163,000 - West Des Moines, IA - $100,000 - $163,000 - Columbus, OH - $100,000 - $163,000- San Antonio, TX - $110,000 - $179,000 - Minneapolis, MN - Pay Range Reflected is the base pay range offered for this position. Pay may vary depending on factors including but not limited to demonstrated examples of prior performance, skills, experience, or work location. Employees may also be eligible for incentive opportunities. $100,000.00 - $179,000.00 Benefits: - Health benefits - 401(k) Plan - Paid time off - Disability benefits - Life insurance, critical illness insurance, and accident insurance - Parental leave - Critical caregiving leave - Discounts and savings - Commuter benefits - Tuition reimbursement - Scholarships for dependent children - Adoption reimbursement Schedule: hybrid work schedule (mentioned). Could be a separate Schedule section. We need to decide which headings to use: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We have content for About the role, Responsibilities, Required Qualifications (could be Requirements), Desired Qualifications (could be Qualifications or Skills). We have Skills maybe from desired qualifications (development experience, IaC, DevSecOps, vendor tools, GHAS, API dev). Could put under Skills. We have Pay (salary ranges). We have Benefits. We have Schedule (hybrid work schedule). Also Job Expectations includes AI proficiency etc. Could be part of Responsibilities or maybe a separate section like Expectations but not in allowed headings. We could incorporate those into Responsibilities or maybe under Qualifications? The spec says we should only use those headings; we can't create new headings like Expectations. So we need to fit that content somewhere appropriate. Perhaps under Responsibilities (since they are expectations). Or under Qualifications? The AI proficiency expectations are more like job expectations, could be placed under Responsibilities as additional duties. We'll add them to Responsibilities list. Also note "This position is not eligible for Visa sponsorship" - that's a condition, could be under Responsibilities or maybe under a separate section but we don't have a heading for that. Could add as a list item under Responsibilities. We must not repeat the job title as heading. Already not. We must not include Job ID/requisition numbers as headings; we can drop them. We must not include boilerplate like EEO, legal, etc. Remove. We must not create Pay/Schedule/Benefits sections unless posting actually states them. It does state Pay (salary ranges), Benefits, Schedule (hybrid). So we include those. We must not emit a heading followed by filler/placeholder text like "commensurate with experience", etc. We have no such. Now produce HTML fragment. Structure:

About the role

Wells Fargo is seeking a Senior Information Security Engineer to join our Application Security Team.

Responsibilities

• Design and implement repeatable, scalable, and automated AppSec processes
• Provide hands-on technical leadership in tooling integration, automation, and process execution
• Implement ongoing product (internal and vendor) enhancements and fine-tuning of rules to increase the precision in identifying and prioritizing application security defects.
• Manage upgrades, resiliency, continuity, and compliance with enterprise standards.
• Recommend mitigation strategies for identified application security risks
• Serve as an AppSec representative in cross-functional governance and technical forums
• Support integration of AppSec controls across enterprise tools and CI/CD pipelines
• Support reporting of AppSec processes, execution status, and outcomes
• Collaborate with control management and cybersecurity leadership to design new security controls
• Support internal and external audits, regulatory reviews, and third-party assessments
• Demonstrate proficiency in using AI-assisted development and analysis tools (e.g., GitHub Copilot and approved code-centric agents)
• Leverage AI to accelerate system design, coding, testing, analysis, and troubleshooting
• Apply strong technical judgment when validating and integrating AI-assisted outputs into solutions
• Understand and account for model limitations, security risks, and operational considerations
• Apply AI responsibly in development and production environments
• Ensure AI usage aligns with security, compliance, privacy, and ethical standards
• This position offers a hybrid work schedule
• This position is not eligible for Visa sponsorship

But note we have Schedule section separate; we might not need to duplicate hybrid schedule in Responsibilities if we have Schedule section. However the spec says we should include a section only when posting has real specific content. It does have hybrid schedule, so we can have Schedule section. The responsibilities list could still include other expectations but we could move hybrid schedule and visa sponsorship to Schedule section? Schedule section likely just about work schedule. Visa sponsorship is not schedule. Could keep visa sponsorship under Responsibilities or maybe under a separate section like Requirements? Not appropriate. We'll keep visa sponsorship under Responsibilities as a note. But we might duplicate hybrid schedule if we also have Schedule section. To avoid duplication, we could keep hybrid schedule only in Schedule section and not in Responsibilities. However the responsibilities list originally didn't include hybrid schedule; it was under Job Expectations. So we can move hybrid schedule to Schedule section, and keep visa sponsorship maybe under Responsibilities as a note. Or we could put visa sponsorship also under Responsibilities. Let's decide: Responsibilities list will contain the core duties (the bullet list from "In This Role, You Will" plus the AI expectations). We'll keep visa sponsorship under Responsibilities as a note? Might be odd but okay. Schedule section:

Schedule

Hybrid work schedule

Pay section:

Pay

• $100,000 - $163,000 - Charlotte, NC
... etc. Also include the note about base pay range and incentive opportunities? That's substantive; we can include as a

after list. Benefits section:

Benefits

list each benefit. Requirements section: maybe combine Required Qualifications under

Requirements

. Qualifications section maybe for Desired Qualifications? Or we could have Requirements for required, Qualifications for desired, Skills for specific technical skills. Let's map: - Requirements: Required Qualifications list. - Qualifications: Desired Qualifications list (maybe treat as qualifications). - Skills: maybe extract specific technical skills from desired qualifications: development experience in more than one language, IaC, DevSecOps/Automation, vendor tools, GHAS, API development. Could be a separate Skills section. But we must avoid thin sections. If we split too much, we may have thin sections. However we have enough content for each. Let's see: Requirements (Required Qualifications) has 7 bullet points. Qualifications (Desired Qualifications) has 6 bullet points. Skills could be derived from Desired Qual