Principal Application Security Engineer

Join Cboe's Cybersecurity team as a Principal Application Security Engineer. In this role, you will provide senior technical leadership and end-to-end ownership for embedding security across our hybrid engineering ecosystem. You will partner closely with application, platform, and infrastructure teams to define secure architecture patterns, shape strategic security direction, and drive implementation of security controls throughout the software development lifecycle. This position requires deep hands-on expertise, strong systems thinking, and the ability to influence engineering practices at scale.

Missions

• Assurer la direction technique et la responsabilité de l'intégration de la sécurité dans l'écosystème d'ingénierie hybride de l'entreprise.
• Collaborer avec les équipes d'application, de plateforme et d'infrastructure pour définir des modèles d'architecture sécurisés par défaut et diriger la mise en œuvre des contrôles de sécurité tout au long du cycle de vie du développement logiciel.
• Établir et faire évoluer les normes de sécurité des applications et des API, y compris les modèles d'authentification et d'autorisation, et fournir des conseils de niveau principal pour les changements de code et de conception à haut risque.

Profil recherché

- 12+ years of experience in application security, product security, or software engineering, including significant experience shaping architecture, setting standards, and driving security outcomes across complex production environments

- Bachelor's degree in Computer Science, Information Security, or related field preferred

- Experience directly writing and delivering production software as a software engineer

- Relevant certifications preferred (e.g., CSSLP, CKS, OSCP, AWS/Azure Security Specialty)

- Hands-on experience integrating DevSecOps tooling (SAST, SCA, secret scanning, IaC/container scanning) into CI/CD pipelines

- Experience securing hybrid environments with workloads running in both public cloud (EKS, AKS, GKE) and on-prem Kubernetes platforms

- Proven ability to read, write, and review production-grade code in at least one modern backend language (e.g., C++, Go, Java, C#, Python, Node.js), with the judgment to guide secure engineering decisions in high-impact systems

- Strong working knowledge of Kubernetes security primitives (RBAC, namespaces, service accounts, pod security) and container build practices

- Exceptional communication, influence, and technical leadership skills, with a demonstrated ability to drive alignment, establish direction, and own outcomes across engineering, platform, and security stakeholders

- Candidates must be legally authorized to work in the United States without the need for employer sponsorship now or in the future