Lead Software Engineer-Information Security

Wells Fargo Bank•Charlotte, NC

2d•Hybrid

About The Position

Wells Fargo is seeking a Lead Software Engineer in Information Security to support the daily operations of the Application Security Champion (ASC) operating model. As a Core Application Security Champion, this role provides subject-matter expertise and leadership to scale the security program across thousands of global applications, supporting engineering teams and mentoring Satellite ASCs embedded within development squads. The role advises on secure development, vulnerability remediation, threat modeling, and security tooling; leads secure design reviews and architecture consultations; and drives automated security tool integrations into CI/CD pipelines. It also contributes to security metrics, policy and control frameworks, governance, and continuous improvement. The Core ASC serves as a senior technical advisor for the Satellite ASC Program, partnering with Product, Engineering, and Risk leaders to define secure design patterns and control objectives, and escalating critical findings in line with enterprise risk tolerance. The position requires additional hours as needed and meeting the current in-office expectation of an average of three days per week. It is not eligible for visa sponsorship. The stated base pay range is $119,000 to $206,000; pay may vary based on performance, skills, experience, and work location. Employees may also be eligible for incentive opportunities.

Requirements

At least 5 years of Software Engineering experience, or equivalent demonstrated through work experience, training, military experience, or education.
At least 5 years of experience in Application Security, Secure Software Development, Product Security, or DevSecOps.
Strong knowledge of secure software development practices and modern application architectures, including cloud-native platforms, microservices, and APIs.
Experience performing secure code reviews and using application security testing tools, including SAST, DAST, SCA, and GitHub Advanced Security (GHAS).
Experience implementing Secure Software Development Lifecycle (SSDLC) practices, threat modeling methodologies such as STRIDE or PASTA, and OWASP security standards.
Experience partnering with development teams to integrate security controls throughout the software development lifecycle.
Ability to work additional hours as needed.
Ability to meet in-office expectations, currently an average of three days per week.
Ability to manage highly complex issues and negotiate solutions.
Ability to interact and communicate effectively with all levels of an organization, including executives.

Nice To Haves

At least 1 year of experience with Fortify Code Analyzer and Checkmarx.
At least 1 year of experience with Black Duck Software Composition Analysis (SCA).
At least 1 year of experience with Static Application Security Testing (SAST) tools.
Experience working in Agile and DevOps environments using tools such as GitHub, Jira, and Azure DevOps.
Knowledge of regulatory, risk, and compliance frameworks, including NIST, ISO 27001, and CRI Profile.
Experience scaling application security programs across large, federated, or decentralized organizations.
Industry-recognized application security certifications such as CSSLP, GWAPT, OSWE, or SANS/GIAC certifications (GSSP, GWEB, or equivalent).
Strong ability to influence technical teams, manage competing priorities, and drive security outcomes without direct authority.
Experience developing and delivering secure coding training, developer enablement programs, or application security awareness initiatives.
Experience leading security initiatives within cloud-native and DevSecOps environments.
Demonstrated ability to build strong partnerships with engineering, architecture, risk, and technology teams to improve application security posture.

Responsibilities

Provide technical guidance on secure coding, vulnerability remediation, threat modeling, and security tools.
Serve as the escalation point for Satellite ASCs and ensure quality assurance and quality control of findings, particularly in high-risk and regulatory environments.
Lead and improve Satellite ASC onboarding, advanced training, and mentorship.
Participate in and lead secure design reviews, code analysis, and architecture consultations across development teams.
Drive and maintain automated security tooling integrations in CI/CD, including SAST, SCA, secrets scanning, and infrastructure-as-code reviews.
Support the creation and tracking of security KPIs and metrics dashboards to measure risk reduction and program impact.
Help shape policy and control frameworks that balance developer velocity with security assurance.
Contribute to governance and continuous improvement of the Satellite ASC Program.
Act as a senior advisor and technical lead, helping define program governance, oversight, and continuous improvement.
Partner with Product, Engineering, and Risk leaders to define secure design patterns and control objectives for cloud and enterprise systems.
Lead the review and escalation process for critical findings, ensuring alignment with enterprise risk tolerance.
Coach and guide other Core ASCs to increase the capability and impact of the Core ASC Center of Excellence.