Security Engineer IV - Application Security

This job posting is anticipated to remain open for 30 days, from 10-Nov-2026. The posting may close early due to the volume of applicants.

Join a financial services firm where your contributions are valued. Edward Jones is a Fortune 500¹ company where people come first. With over 9 million clients and 20,000 financial advisors across the U.S. and Canada, we’re proud to be privately-owned, placing the focus on our clients rather than shareholder returns.

Behind everything we do is our purpose: We partner for positive impact to improve the lives of our clients and colleagues, and together, better our communities and society. We are an innovative, flexible, and inclusive organization that attracts, develops, and inspires performance excellence and a sense of belonging.

People are at the center of our partnership. Edward Jones associates are seen, heard, respected, and supported. This is what we believe makes us the best place to start or build your career.

View our Purpose, Inclusion and Citizenship Report (https://careers.edwardjones.com/blog/edward-jones-releases-annual-purpose-inclusion-and-citizenship-report/?codes=DIRECT&utm\_source=DIRECT) .

¹Fortune 500, published June 2024, data as of December 2023. Compensation provided for using, not obtaining, the rating.

Overview:

A hands-on practitioner who reduces application and software supply chain risk across the SDLC. Partners with engineering teams to turn security standards and findings into practical controls in code, CI/CD, and production, while building reusable automation that preserves developer flow and audit readiness.

What You'll Do:

• Provide security guidance for web applications, APIs, cloud-native services, and agent-enabled workflows.

• Maintain secure coding patterns and controls aligned to OWASP ASVS, NIST SSDF, and internal SDLC standards.

• Engineer scalable SAST, SCA, secret, IaC, DAST, API, and container/artifact controls.

• Integrate risk-based checks into GitHub and CI/CD workflows with clear pass, warn, exception, and escalation behavior.

• Tune findings by exploitability, reachability, and asset criticality; automate Jira work items, evidence capture, and policy-as-code.

• Partner with platform teams on JFrog Curation, provenance, signed builds, and SLSA-aligned controls.

• Triage complex vulnerabilities, guide secure fixes, and verify remediation through retesting and automated evidence.

• Coordinate penetration testing, track accepted risks, and drive systemic prevention of recurring defects.

• Act as a senior partner to engineers, architects, product owners, DevSecOps, cloud security, and risk teams.

• Mentor engineers and security champions; lead exception and risk discussions with accountable owners.

What Experience You'll Need

Experience securing web applications, APIs, microservices, and cloud-native systems, with deep knowledge of OWASP Top 10 and API Security Top 10.

Hands-on secure code review, vulnerability triage, and operating or integrating SAST, SCA, DAST, secret, IaC, container, and API security tools.

Working knowledge of IAM, OAuth 2.0, OpenID Connect, TLS, secrets management, and secure logging.

Ability to execute independently from discovery to verified closure and to communicate technical risk clearly to engineering and risk stakeholders.

Proficiency in a language such as Python, Java, JavaScript/TypeScript, C#, or Go to review code and automate controls.

Experience with GitHub Actions and CI/CD workflows, including automated security checks, artifact repositories, and cloud or container platforms.

Ability to build reliable policy-as-code, integrations, and evidence workflows; understanding of SBOMs, provenance, signing, and SLSA.

Experience using AI-assisted development tools and assessing security risks in AI-generated code and AI-enabled workflows.

What Could Set You Apart?

Regulated-industry experience (financial services, healthcare); familiarity with NIST SSDF, NIST CSF, OWASP SAMM/ASVS, ISO 27001, CIS Controls, SLSA, and FINOS controls.

Experience with GitHub Advanced Security, Jira, Confluence, JFrog, Dynatrace, or Traceable.

Knowledge of AI application risks such as prompt injection, sensitive-data exposure, and excessive agency.

Certifications such as CSSLP, CISSP, GWEB, GWAPT, OSWE, or cloud security credentials are beneficial, not required.

Candidates that live within a commutable distance from our Tempe, AZ and St. Louis, MO home office locations are expected to work in the office four days per week effective June 1, 2026. Before June 1, 2026, candidates that live within a commutable distance from our Tempe, AZ and St. Louis, MO home office locations are expected to work in the office three days per week, with preference for Tuesday through Thursday.

At Edward Jones, we are building a place where everyone feels like they belong. We're proud of our associates' contributions to the firm and the recognitions we have received.

Check out our U.S. awards and accolades: Insights & Information Blog Postings about Edward Jones (https://careers.edwardjones.com/blog/?\_sft\_category=awards-accolades)

Check out our Canadian awards and accolades: Insights & Information Blog Postings about Edward Jones (https://careers.edwardjones.com/en-CA/blogs/?\_sft\_category=awards-accolades-en-ca)

Edward Jones does not discriminate on the basis of race, color, gender, religion, national origin, age, disability, sexual orientation, pregnancy, veteran status, genetic information or any other basis prohibited by applicable law.

Edward Jones' compensation and benefits package includes medical and prescription drug, dental, vision, voluntary benefits (such as accident, hospital indemnity, and critical illness), short- and long-term disability, basic life, and basic AD&D coverage. Short- and long-term disability, basic life, and basic AD&D coverage are provided at no cost to associates. Edward Jones offers a 401k retirement plan, and tax-advantaged accounts: health savings account, and flexible spending account. Edward Jones observes ten paid holidays and provides 15 days of vacation for new associates beginning on January 1 of each year, as well as sick time, personal days, and a paid day for volunteerism. Associates may be eligible for bonuses and profit sharing. All associates are eligible for the firm's Employee Assistance Program. For more information on the Benefits available to Edward Jones associates, please visit our benefits page (https://secure.edwardjonesbenefits.com/fleet/public/index/f914262d-0362-4682-bd1e-0ccd25f1dfb1) .