Engineer, Application Security

Intercontinental Exchange Holdings, Inc. • Jacksonville, AR

2d

About The Position

An ICE IS AppSec Engineer is part of a team responsible for ensuring that ICE produces and maintains secure applications. The role influences secure design, performs code analysis, identifies vulnerabilities through hands-on penetration testing, assists developers with remediation, and communicates findings to developers, QA teams, and management. The position operates across the Application Development Security Lifecycle, from design review through automated and hands-on testing, and contributes to security policies, standards, tooling, and developer education.

Requirements

• University degree in Computer Science, Engineering, MIS, CIS, or a related discipline.
• Software engineering experience in Java, C++, .NET, and/or related languages.
• Expertise deploying, configuring, and using SAST, DAST, and Software Composition tools in large environments.
• Experience designing solutions that integrate transparently with CI/CD pipelines.
• Familiarity with application development in large cloud environments.

Nice To Haves

• Interest in or exposure to AI and large language models (LLMs), including emerging security risks such as prompt injection.
• Experience documenting and effectively publishing technology guidance and repeatable processes.
• Experience mentoring peers in groups and individually.
• Ability to improve processes and introduce superior technology.
• Initiative in learning business goals, liaising with other departments, and identifying ways to increase productivity in other ICE groups and offices.

Responsibilities

• Operate the Application Development Security Lifecycle from design review through automated and hands-on testing.
• Maintain and contribute to Application Development Security Policies and standards, staying current with industry trends and publications from organizations such as NIST, OWASP, and SANS.
• Work with development teams to establish security requirements early in the SDLC and provide security subject matter expertise during the development of new projects and releases.
• Implement, maintain, and integrate technologies for application security assessment, including static code analyzers (SAST), dynamic testing (DAST) tools, software composition scanners, Web Application Firewall (WAF), and bug bounty programs, with a focus on automation.
• Keep software engineers informed about secure coding practices and build rapport with the application development community through training sessions, one-on-one education, Intranet blogs, and other opportunities.
• Perform code analysis and hands-on penetration testing to identify vulnerabilities.
• Assist developers with remediation efforts and communicate findings to developers, QA teams, and management.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level