Application Security Architect - AI Harness

Edward Jones

11d

About The Position

The Application Security Architect, Agentic Secure Code Architect is a hands-on, architecture-focused individual contributor responsible for designing, integrating, maintaining, and improving a CI/CD-integrated AI evaluation harness. The harness assesses application and infrastructure source code for security vulnerabilities and insecure-design practices. The role combines application security, DevSecOps, AI engineering, secure SDLC governance, and financial-services compliance, emphasizing source-code protection, enterprise controls governance, repeatability, auditability, measurable risk reduction, and developer trust. The architect designs AI-assisted secure-code review methods that complement established security testing and assessment practices; maintains evaluation benchmarks, test cases, model and prompt versions, retrieval configurations, scoring criteria, and regression tests; and governs approved vendor and frontier models. The role also establishes safeguards for proprietary production code and routes validated findings into developer workflows with actionable remediation guidance and feedback loops. Candidates near Edward Jones’ Tempe, Arizona, or St. Louis, Missouri, offices are expected to work onsite four days per week beginning June 1, 2026. Before that date, they are expected to work onsite three days per week, with Tuesday through Thursday preferred. The posting does not specify an arrangement for candidates outside commuting distance of those offices.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, Software Engineering, Information Technology, Engineering, or a related field.
10+ years of experience in application security, secure software engineering, DevSecOps, security architecture, or related cybersecurity roles.
Deep expertise in secure code review, vulnerability detection, threat modeling, exploitability analysis, and secure SDLC practices.
Experience conducting vulnerability and penetration-test readouts or walkthroughs with stakeholders.
Hands-on experience with SAST, SCA, DAST, secrets scanning, API security testing, container security, infrastructure-as-code scanning, and developer workflow integrations.
Experience integrating security capabilities into SDLC pipeline tooling, including Jenkins, GitHub Actions, GitHub Enterprise, Atlassian, developer portals, source-control workflows, and DevSecOps toolchains.
Practical experience using LLMs or AI models for code review, software engineering, vulnerability research, security analysis, or developer productivity use cases.
Understanding of prompt engineering and optimization, RAG, model evaluation, AI guardrails, human-in-the-loop review, prompt and model versioning, and vendor/open-source model trade-offs.
Experience designing or maintaining evaluation harnesses, benchmark suites, regression tests, validation pipelines, and test orchestration workflows.
Strong understanding of OWASP, CWE, CVSS, NIST SSDF, AI security risks, regulated source-code handling, auditability, and vendor/model governance.

Nice To Haves

Master’s degree or relevant certifications such as CISSP, CSSLP, OSWE, GWAPT, CCSP, cloud security, Kubernetes security, or AI governance certifications.
Experience delivering AI-assisted application security capabilities in a Fortune 500 or highly regulated financial-services environment.
Hands-on experience with enterprise AI platforms, approved vendor models, open-source models, secure hosting, RAG, and AI governance controls.
Experience building secure-code-review automation, custom static-analysis rules, vulnerability-detection pipelines, benchmark datasets, or AI-based developer tooling.
Demonstrated success reducing application-security risk through improved detection accuracy, lower false positives, faster remediation, and stronger developer enablement.

Responsibilities

Architect a CI/CD-integrated AI secure-code evaluation harness for source-code repositories and Secure SDLC lifecycles as a hands-on individual contributor.
Integrate evaluation workflows with pipeline tooling and application security reporting platforms.
Design AI-assisted secure-code review methods that complement SAST, SCA, DAST, secrets scanning, IaC scanning, threat modeling, security testing, and manual assessments.
Maintain benchmarks, golden test cases, prompt and model versions, retrieval configurations, scoring criteria, and regression tests for AI-generated findings.
Govern approved vendor and frontier AI models, including model selection and routing, fallback patterns, accuracy, explainability, cost, and data-protection trade-offs.
Define safeguards for proprietary production code, including access controls, approved model endpoints, data minimization, retention limits, secure logging, and evidence handling.
Route validated findings into developer workflows with actionable remediation guidance and feedback loops to reduce false positives and improve adoption.
Define metrics and control evidence aligned with internal governance processes and applicable financial-services authorities and cybersecurity frameworks.

Benefits

Medical and prescription drug coverage
Dental insurance
Vision insurance
Voluntary benefits, including accident, hospital indemnity, and critical illness coverage
Short- and long-term disability coverage at no cost to associates
Basic life and basic AD&D coverage at no cost to associates
401(k) retirement plan
Health savings account
Flexible spending account
Ten paid holidays
15 days of vacation for new associates beginning on January 1 of each year
Sick time
Personal days
Paid day for volunteerism
Associates may be eligible for bonuses and profit sharing
Employee Assistance Program