Note: The job is a remote job and is open to candidates in USA. IBM Software develops AI-powered, cloud-native products, including Confluent’s data streaming platform. The Staff Application Security Engineer will shape application security strategy and architecture across on-premises products and cloud services, partnering with Engineering and Product leadership to mitigate risks. The role will lead security automation, threat modeling, design reviews, vulnerability research, and secure-by-design practices across the product lifecycle.
Responsibilities
- Partner closely with Engineering, Product, and Platform teams to identify security risks early, influence architectural decisions, and drive adoption of secure-by-design practices across the organization
- Define and standardize threat modeling frameworks and security design standards, and lead security design reviews for complex, distributed systems, providing actionable architectural guidance to engineers and product managers
- Serve as the subject matter expert (SME) for product security implementation reviews, overseeing security code reviews and API security testing while providing definitive remediation guidance
- Architect and drive the roadmap for security automation, building scalable software security tooling to transform product security operations and vulnerability management practices
- Design and lead the deployment of automation and orchestration frameworks that integrate security seamlessly into the cloud-native deployment pipeline
- Proactively identify new vulnerability classes, lead research initiatives and orchestrate complex table-top exercises to keep the organization ahead of the evolving threat landscape
- Strategically identify and deploy advanced technology controls to maximize observability and harden key attack surfaces across the ecosystem
Skills
- Bachelor's Degree
- 10+ years of hands-on application security experience, who can drive measurable security improvements across large-scale, distributed systems and global engineering organizations
- Comprehensive knowledge of security fundamentals as applied to modern web applications and cloud-native platforms including secure software design and architecture, secure coding practices, common vulnerability classes
- Ability to partner as a trusted peer with Engineering and Product leadership to embed security into the core architecture of the organization
- Ability to lead technical investigation and response to application security incidents while driving preventive improvements through architecture and automation
- Proven experience evolving the software development lifecycle to embed security by default, from securing CI/CD pipelines and build systems to implementing automated security guardrails in cloud-native deployment workflows
- Passionate about applying AI and LLMs to automate complex security workflows, reduce manual toil, and drive measurable improvements in security outcomes
- Experience in Go, Python, or Java, with the ability to design and build scalable security automation frameworks
- Experience in leading cross-functional initiatives in distributed environments, translating security requirements into clear, executable technical roadmaps
- A data-driven decision-maker who can balance security requirements with business velocity and engineering trade-offs to deliver outcomes
- Ability to raise the organization's security bar through architectural reviews, advanced technical guidance, and the development of engineers across all levels
- Master's Degree
- 12+ years of hands-on application security experience
Benefits
- Healthcare benefits including medical and prescription drug coverage, dental, vision, and mental health and well-being coverage
- 401(k) plan
- Cash balance pension plan
- IBM Employee Stock Purchase Plan
- Financial counseling
- Life insurance
- Short- and long-term disability coverage
- Opportunities for performance-based salary incentive programs
- 12 paid holidays
- Minimum 56 hours of sick time
- 120 hours of vacation
- 12 weeks of parental bonding leave in accordance with IBM Policy
- Other paid care leave programs
- Paid family leave benefits for eligible employees where required by applicable law
- Training and educational resources on a personalized, AI-driven learning platform
- Industry-recognized certification opportunities
- Diverse and inclusive employee resource groups
- Giving and volunteer opportunities
- Discounts on retail products, services, and experiences
- Remote work arrangement
Company Overview