Lead Software Engineer-Information Security
Wells Fargo1 day ago
Minneapolis, MN, USA +2 moreStaff+
Base Salary
$119k - $206k/yr
Responsibilities
- Provide technical guidance on secure coding, vulnerability remediation, threat modeling, and application security tools.
- Serve as the escalation point and subject matter expert for Satellite Application Security Champions, including quality assurance of findings.
- Lead onboarding, advanced training, mentorship, and enablement for Satellite ASCs and Core ASCs.
- Lead secure design reviews, code analysis, architecture consultations, and critical-finding escalation across development teams.
- Drive automated security tooling integrations for SAST, SCA, secrets scanning, and infrastructure-as-code reviews.
- Create and track security KPIs and metrics dashboards to measure risk reduction and program impact.
- Help define security policies, control frameworks, governance, secure design patterns, and control objectives.
- Partner with Product, Engineering, Risk, architecture, and technology leaders to improve application security posture.
- Coach and guide Core ASCs and support continuous improvement of the ASC Center of Excellence.
Requirements
- At least 5 years of software engineering experience or equivalent experience demonstrated through work, training, military experience, or education.
- At least 5 years of experience in application security, secure software development, product security, or DevSecOps.
- Strong knowledge of secure software development practices and modern application architectures, including cloud-native platforms, microservices, and APIs.
- Experience performing secure code reviews and using SAST, DAST, SCA, and GitHub Advanced Security.
- Experience implementing SSDLC practices, threat modeling methodologies such as STRIDE and PASTA, and OWASP security standards.
- Experience partnering with development teams to integrate security controls throughout the software development lifecycle.
- Preferred: at least 1 year of experience with Fortify Code Analyzer and Checkmarx.
- Preferred: at least 1 year of experience with Black Duck Software Composition Analysis and SAST tools.
- Preferred: experience with GitHub, Jira, and Azure DevOps in Agile and DevOps environments.
- Preferred: knowledge of NIST, ISO 27001, and CRI Profile frameworks.
- Preferred: experience scaling application security programs across large, federated, or decentralized organizations.
- Preferred: industry-recognized application security certifications such as CSSLP, GWAPT, OSWE, or SANS/GIAC certifications.
- Ability to influence technical teams, manage competing priorities, and drive security outcomes without direct authority.
- Experience developing secure coding training, developer enablement programs, or application security awareness initiatives.
- Ability to manage complex issues, negotiate solutions, and communicate effectively at all organizational levels, including executives.
Benefits
- Health benefits, 401(k) plan, paid time off, disability benefits, life insurance, critical illness insurance, and accident insurance.
- Parental leave, critical caregiving leave, commuter benefits, tuition reimbursement, dependent-child scholarships, adoption reimbursement, and discounts and savings.
- Meet in-office expectations, currently averaging 3 days per week.
- Ability to work additional hours as needed.
- Position is not eligible for visa sponsorship.
Categories
About Wells Fargo
Wells Fargo & Company is a U.S.-based financial services firm providing consumer and commercial banking, mortgages, credit, and wealth/investment services to individuals, small businesses, and enterprises. It earns revenue from interest income and fees across retail banking, payments, lending, and capital markets. Founded in 1852 and headquartered in San Francisco, it is publicly traded on the NYSE (WFC) and operates nationally with offices in multiple countries.