Security Engineer III

JPMorganChase•Seattle, WA

About The Position

As a Security Engineer III at JPMorganChase within the Cybersecurity and Technology Controls line of business, you are a seasoned member of a team delivering software solutions that meet functional and user requirements while preventing misuse, circumvention, and malicious behavior. You will carry out critical technology solutions using tamper-proof, audit-defensible methods across technical areas and business functions to support the firm’s business objectives. The role covers the full software development lifecycle, secure software engineering, cloud-native solution delivery, infrastructure as code, and DevOps practices. It also includes production support and incident response, participation in an on-call rotation, and the responsible use of enterprise-authorized AI capabilities for security analysis and vulnerability assessment work.

Requirements

Formal training or certification in security engineering concepts and at least 3 years of applied experience.
Experience developing security engineering solutions.
Documented experience building enterprise applications using Java.
Documented experience using AWS or other public cloud technologies.
Demonstrated experience using enterprise-authorized AI capabilities in the work environment to support security engineering workflows, with strong validation habits and awareness of data sensitivity.
Ability to review and validate AI-assisted code and security recommendations before use, escalate when uncertain, and follow security and data-handling requirements.
Proficiency in coding in one or more languages.
Knowledge of SDLC execution, including agile methodologies such as CI/CD, application resiliency, and security.
Strong working knowledge of information and network security, IT risk management, and architectural concepts and patterns.
Advanced experience using approved tools to analyze incident data and support vulnerability assessment.

Responsibilities

Design, build, test, and maintain software applications across the full SDLC, including requirements, implementation, code reviews, CI/CD, deployment, monitoring, and ongoing support, in partnership with product, QA, and engineering teams.
Follow software security best practices, including secure coding standards, dependency and secret management, vulnerability remediation, and security testing throughout the SDLC.
Develop and manage Infrastructure as Code, such as Terraform, CloudFormation, or CDK, to provision, version-control, and operate scalable and secure environments.
Build and deliver cloud-native solutions using cloud platforms, including core services, security and IAM, networking, and performance and scalability considerations.
Apply DevOps practices to improve developer productivity and system reliability through CI/CD pipelines, automated testing, release automation, monitoring and alerting, and incident management.
Participate in an on-call rotation and provide customer support by triaging incidents, troubleshooting production issues, communicating status and ETAs, and driving root-cause analysis and preventative fixes.
Execute security solutions design, development, and technical troubleshooting, applying knowledge of existing security solutions to satisfy security requirements for internal clients such as product, platform, and application owners.
Use enterprise-authorized AI capabilities in the work environment to accelerate security analysis and vulnerability assessment documentation, validating outputs and handling sensitive data appropriately.
Create secure, high-quality production code and maintain algorithms that run synchronously with appropriate systems.
Lead delivery of continuity-related awareness, training, educational activities, and exercises.
Apply reuse-first, AI-assisted practices within SDLC and toolchain routines to strengthen security testing and control validation, ensuring traceability and auditability and alignment with resiliency and security expectations.
Review and validate AI-assisted code and security recommendations before use, escalating when uncertain and following security and data-handling requirements.