Application Security Engineer
Charles Schwab1 day ago
Omaha, NE, USA +2 moreMid Level
H1B sponsor
Base Salary
$110k - $135k/yr
Responsibilities
- Develop and scale application security tools, services, controls, and secure software development practices.
- Provide security architecture guidance and support security requirements analysis, code reviews, threat modeling, and architectural risk assessments.
- Build Python automation for enterprise REST API integrations, repository management, content discovery, workflow orchestration, and encoded file handling.
- Author and manage custom CodeQL queries, including QL packs, databases, dependency resolution, and false-positive reduction.
- Engineer GitHub Advanced Security capabilities, including Code Scanning, Secret Scanning, Dependency Review, alert triage, and remediation workflows.
- Architect reusable GitHub Actions CI/CD workflows with callable workflows, matrix strategies, cross-repository authentication, and centralized governance.
- Analyze and validate SARIF output, static analysis findings, false positives, and automated reporting across codebases.
- Design enterprise Git workflows, branching strategies, release coordination, branch protection, cross-organization pull requests, and versioning policies.
- Create vulnerable code patterns to test static analysis coverage, detection accuracy, and severity classification.
- Design centralized configuration and workflow distribution for multi-repository environments.
- Govern enterprise package registries, dependency controls, artifact repositories, and vulnerable dependency testing.
- Produce technical documentation, Architecture Decision Records, onboarding guides, and operational runbooks.
Requirements
- At least two years of experience working with static analysis or threat modeling tools.
- Prior engineering experience in a Software Security Assurance or Application Security team.
- Experience with application security tools including Software Composition Analysis, Static Application Security Testing, secrets management solutions, and Fortify.
- Solid application engineering experience and understanding of common application vulnerabilities, attack vectors, remediation strategies, and secure software design principles.
- Strong understanding of secure coding practices, code review processes, threat modeling, security requirements analysis, and architectural risk assessment.
- Familiarity with OWASP, CIS, NIST, and secure software development lifecycle practices.
- Strong proficiency in Python automation and large-scale REST API integrations.
- Strong understanding of CodeQL query authoring, QL pack management, database creation, dependency resolution, and source/sink filtering.
- Deep familiarity with GitHub Advanced Security, including Code Scanning, Secret Scanning, Dependency Review, custom queries, and alert workflows.
- Expertise architecting reusable and scalable GitHub Actions workflows.
- Knowledge of the SARIF specification and static analysis result interpretation.
- Experience with enterprise Git workflows, release management, branching strategies, repository protection, and versioning policies.
- Understanding of software weakness classes, vulnerable code patterns, package ecosystems, dependency governance, and artifact repository configuration.
- Excellent written communication skills and experience creating technical documentation and architecture decision records.
About Charles Schwab
Charles Schwab provides brokerage, banking, and wealth management services for individual investors and independent investment advisors. Its business spans trading platforms, advisory and custody services (Schwab Advisor Services), ETFs and mutual funds, and a U.S. bank offering deposits and lending. Founded in 1971 and headquartered in Westlake, Texas, Schwab is publicly traded on the NYSE (SCHW) and expanded its retail and advisor footprint through the acquisition of TD Ameritrade.