{"id":1730654,"url":"https://alion.io/job/charles-schwab-application-security-engineer","title":"Application Security Engineer","company":{"id":5314,"name":"Charles Schwab","domain":"schwab.com","url":"https://alion.io/company/charles-schwab-inc","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Radancy","truth_index":{"grade":"B","score":80,"open_postings":4,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":8,"computed_at":"2026-10-03T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Omaha, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":110000,"max":135000,"currency":"USD","period":"year","gross":null,"usd_annual":135000},"salary_estimate":null,"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"Agile","optional":false},{"name":"Fortify","optional":false},{"name":"OWASP","optional":false},{"name":"Threat Modeling","optional":false},{"name":"CI/CD","optional":true},{"name":"CodeQL","optional":true},{"name":"Git","optional":true},{"name":"GitHub","optional":true},{"name":"GitHub Actions","optional":true},{"name":"Platform Engineering","optional":true},{"name":"Python","optional":true},{"name":"Rest API","optional":true}],"status":"live","first_seen_at":"2026-10-03T00:02:30Z","employer_posted_date":"2026-10-02","last_verified_at":"2026-10-04T00:53:16Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Your opportunity\nThe Schwab Application Security team, operating under the leadership of the Chief Information Security Officer (CISO), is responsible for protecting Schwab’s information assets in support of business objectives and in alignment with corporate policies. As a core function within Cybersecurity Services, the Application Security team leads the establishment and ongoing evolution of Schwab’s Secure Software Development Program. This includes the creation and implementation of software security policies and best practices, providing security architecture guidance, conducting software security scanning and penetration testing, and educating developers and testers on secure coding practices.\nThe Software Security Engineer plays a key role in safeguarding software assets by strengthening the development process, enhancing security controls, and reducing defects and vulnerabilities in production environments.\nSuccessful candidates will have prior engineering experience within a Software Security Assurance or Application Security team and a proven ability to partner effectively with development teams to balance security requirements with innovation. They will demonstrate strong analytical skills, including the ability to interpret large volumes of distributed data and translate it into clear, actionable insights. Candidates should also have experience working with a range of application security tools, including Software Composition Analysis (SCA), Static Application Security Testing (SAST), and secrets management solutions.\nIn addition, candidates will bring solid application engineering experience and a strong understanding of common application vulnerabilities, attack vectors, and remediation strategies. They should be familiar with secure software design principles and industry best practices for integrating security into the software development lifecycle. Experience with application security testing tools, such as Fortify, and their integration into agile development environments is expected.\nCandidates should have familiarity with recognized industry frameworks and standards such as OWASP, CIS, and NIST. A minimum of two years of experience working with static analysis or threat modeling tools is expected, along with experience implementing and scaling enterprise application security tools, services, and controls. Finally, candidates must demonstrate a strong understanding of secure coding practices, code review processes, threat modeling, security requirements analysis, and architectural risk assessment.\nWhat you have\nPreferred Qualifications\nPython Automation & API Integration\nStrong proficiency in designing Python-based automation for large-scale REST API integrations, including repository management, content discovery, workflow orchestration, and encoded file handling across enterprise source-control platforms.\nCustom CodeQL Query Development\nStrong understanding of CodeQL query authoring concepts, including QL pack management, database creation, dependency resolution via --search-path, and techniques for minimizing false positives through boundary analysis and source/sink filtering.\nGitHub Advanced Security (GHAS) Platform Engineering\nDeep familiarity with GitHub Advanced Security capabilities, including Code Scanning, Secret Scanning, Dependency Review, custom query configuration, and scalable alert triage and remediation workflows across multiple repositories.\nCI/CD Pipeline Architecture (GitHub Actions)\nDemonstrated expertise in architecting reusable and scalable CI/CD workflows using GitHub Actions, including callable workflows, matrix strategies, cross-repository authentication models, and centralized pipeline governance.\nSARIF Output Analysis & Interpretation\nStrong knowledge of the SARIF specification and its use in static analysis pipelines, including interpreting results, validating findings, identifying false positives, and enabling automated reporting across diverse codebases.\nEnterprise Git Workflow & Release Management\nExperience designing and governing enterprise Git workflows, including structured branching strategies, release coordination, branch protection rules, cross-organization pull requests, and versioning policy enforcement.\nApplication Security Vulnerability Engineering\nSolid understanding of common software weakness classes and the intentional design of vulnerable code patterns to validate static analysis coverage, detection accuracy, and severity classification.\nMulti-Repository Architecture & Configuration Delivery\nProven ability to architect centralized configuration and workflow distribution models for large repository ecosystems, including reusable workflows, configuration validation, and scalable authentication mechanisms.\nEnterprise Package Registry & Dependency Governance\nStrong knowledge of internal package ecosystems and dependency governance, including artifact repository configuration, registry enforcement and blocking strategies, and controlled use of vulnerable dependencies for security testing.\nTechnical Documentation & Architecture Decision Records\nExcellent written communication skills with experience producing high-quality technical documentation, including Architecture Decision Records (ADRs), onboarding guides, and operational runbooks for cross-functional engineering teams.\nWhat’s in it for you\nAt Schwab, you’re empowered to shape your future. We champion your growth through meaningful work, continuous learning, and a culture of trust and collaboration-so you can build the skills to make a lasting impact. Our Hybrid Work and Flexibility approach balances our ongoing commitment to workplace flexibility, serving our clients, and our strong belief in the value of being together in person on a regular basis.\nWe offer a competitive benefits package that takes care of the whole you - both today and in the future:\n401(k) with company match and Employee stock purchase plan\nPaid time for vacation, volunteering, and 28-day sabbatical after every 5 years of service for eligible positions\nPaid parental leave and family building benefits\nTuition reimbursement\nHealth, dental, and vision insurance","description_format":"text","description_chars":6162,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Continuous learning","Hybrid work","Parental leave","Vision insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Financial Services","Commercial & Retail Banks","Asset Management & Funds"],"lifecycle":[{"event":"open","at":"2026-10-03T00:02:30Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 476 · green card filings: 223","filings_12m":476,"filings_prev_12m":595,"green_card_filings_12m":223,"median_offered_wage_usd":155883,"route":null,"cap_exempt":false,"checked_at":"2026-10-03T21:08:04+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":26}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":0,"expected_fill_days":8,"reasons":["conf:5","velocity","win:early","comp:junior,brand"],"computed_at":"2026-10-03T05:45:00Z"},"pay":{"stated_usd_annual":135000,"is_top_pay":true},"html_url":"https://alion.io/job/charles-schwab-application-security-engineer","json_url":"https://alion.io/job/charles-schwab-application-security-engineer.json","meta":{"generated_at":"2026-10-04T03:05:35Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","usage":{"tier":"crawler","counted_by":"address","units_charged":1,"used_today":4691,"day_limit":5000,"remaining_today":309,"minute_limit":60,"resets_at":"2026-10-05T00:00:00Z"}}}