Senior Information Security Engineer

Wells Fargo•Minneapolis, MN

10d•$100,000 - $179,000•Hybrid

About The Position

Wells Fargo is seeking a Senior Information Security Engineer to join its Application Security Team. The role focuses on designing, implementing, and improving scalable, automated application security processes and controls across development workflows. The engineer provides hands-on technical leadership in security tooling integration and automation, enhances security products and detection rules, and supports application security governance, reporting, audits, regulatory reviews, and third-party assessments. The position has a hybrid work schedule and is not eligible for visa sponsorship. It also requires responsible use of AI-assisted development and analysis tools, including validating AI-generated outputs and accounting for security, compliance, privacy, ethical, and operational considerations. The stated base pay range is $100,000–$179,000, with location-specific ranges listed in the posting. Eligible employees may also have incentive opportunities.

Requirements

At least 4 years of Information Security Engineering experience, or equivalent demonstrated through work experience, training, military experience, or education.
Expertise across core Application Security domains: SAST, DAST, SCA, secrets management and detection, and Infrastructure as Code (IaC).
Strong experience integrating SAST, DAST, and SCA tools into SDLC workflows and source code repositories.
Advanced knowledge of GitHub, Jira, ServiceNow, Jenkins, Harness, and CI/CD ecosystems.
Strong understanding of OWASP standards and MITRE CVE/CWE frameworks.
Experience implementing and maturing Secure Software Development Lifecycle (SSDLC) practices across Agile and custom development frameworks.
Familiarity with AI/LLM-enabled development tools, including Cursor, GitHub Copilot, custom LLM integrations, AI-based auto-remediation capabilities, and related governance considerations.
Demonstrate proficiency using AI-assisted development and analysis tools, such as GitHub Copilot and approved code-centric agents.
Apply strong technical judgment when validating and integrating AI-assisted outputs into solutions.

Nice To Haves

At least 4 years of development experience in more than one language.
At least 3 years of using IaC to configure, build, and deploy.
At least 2 years of DevSecOps or automation experience.
Hands-on experience with vendor tools Checkmarx, Blackduck, Prisma, Trufflehog, Synk, Socket, Invicti, or Qualys.
Proven experience with GitHub Advanced Security (GHAS), including secret scanning capabilities.
Experience in API development and custom services.

Responsibilities

Design and implement repeatable, scalable, and automated application security processes.
Provide hands-on technical leadership in tooling integration, automation, and process execution.
Implement ongoing enhancements to internal and vendor products and fine-tune rules to improve the precision of identifying and prioritizing application security defects.
Manage upgrades, resiliency, continuity, and compliance with enterprise standards.
Recommend mitigation strategies for identified application security risks.
Represent Application Security in cross-functional governance and technical forums.
Support integration of application security controls across enterprise tools and CI/CD pipelines.
Support reporting on application security processes, execution status, and outcomes.
Collaborate with control management and cybersecurity leadership to design new security controls.
Support internal and external audits, regulatory reviews, and third-party assessments.
Use AI to accelerate system design, coding, testing, analysis, and troubleshooting while applying technical judgment to validate and integrate AI-assisted outputs.
Account for model limitations, security risks, and operational considerations, and ensure AI use aligns with security, compliance, privacy, and ethical standards.