{"id":2484289,"url":"https://alion.io/job/raymond-james-lead-application-security-engineer","title":"Lead Application Security Engineer","company":{"id":1768977,"name":"Raymond James","domain":"raymondjames.com","url":"https://alion.io/company/raymondjames-com","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":80,"open_postings":22,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":16,"computed_at":"2026-10-23T05:54:15Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Saint Petersburg, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":110000,"max_usd":227000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":398},"experience_years_min":3,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Azure DevOps","optional":false},{"name":"C#","optional":false},{"name":"CI/CD","optional":false},{"name":"GCP","optional":false},{"name":"GitHub","optional":false},{"name":"GitLab","optional":false},{"name":"Go","optional":false},{"name":"GraphQL","optional":false},{"name":"JavaScript","optional":false},{"name":"Jenkins","optional":false},{"name":"Jira","optional":false},{"name":"Kubernetes","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false}],"status":"live","first_seen_at":"2026-09-24T00:00:00Z","employer_posted_date":"2026-09-24","last_verified_at":"2026-10-22T03:53:30Z","board_verified":true,"closed_at":null,"days_open":29,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":29},"description":"Job Description Summary\nThe financial services industry is continuously targeted by sophisticated cyber adversaries ranging from criminal organizations to nation-state actors. Raymond James relies on the Cyber Threat Center (CTC) to identify, assess, and reduce technology risk across the enterprise. The Lead Application Security Engineer will be a hands-on technical leader responsible for integrating security into the software development lifecycle, assessing application and API risk, and enabling development teams to deliver resilient software at scale.This role combines application security engineering, software security assessment, vulnerability analysis, secure software development practices, and cybersecurity architecture. The engineer will build and automate security controls across CI/CD pipelines; perform risk-based testing and threat modeling; and responsibly apply AI-assisted techniques to accelerate vulnerability discovery, triage, validation, and remediation\nJob Description\nThis position follows a hybrid work model, with an expectation to be in the office 3 days per week at the St. Petersburg, FL Corporate Office location.\nPlease note: This role is not eligible for Work Visa sponsorship, either currently or in the future.\nResponsibilities:\nLead application security engineering activities across web applications, APIs, mobile applications, cloud-native services, containers, and supporting platforms.\nEmbed security controls throughout the software development lifecycle (SDLC), including requirements, architecture, design, development, build, test, release, and post-production monitoring.\nDesign, implement, tune, and govern automated security testing in CI/CD pipelines, including static application security testing (SAST), dynamic application security testing (DAST), interactive application security testing (IAST), software composition analysis (SCA), secrets detection, infrastructure-as-code scanning, container image scanning, API security testing, and mobile application testing.\nDevelop reusable automation, integrations, and security-as-code using Python, PowerShell, JavaScript, shell scripting, APIs, webhooks, and pipeline platforms to reduce manual effort and improve control coverage.\nBuild automated workflows that normalize, correlate, enrich, deduplicate, prioritize, ticket, route, retest, and close application vulnerability findings across security tools and engineering systems.\nLeverage AI-assisted application vulnerability analysis to summarize evidence, identify code-to-vulnerability relationships, propose test cases, prioritize likely exploit paths, explain findings to developers, and draft remediation guidance.\nPerform manual and tool-assisted application and API security assessments, validate exploitability, eliminate false positives, create proof-of-concept evidence when appropriate, and provide clear, actionable remediation guidance.\nLead application threat modeling and architecture risk reviews using practical methods such as abuse cases, data-flow analysis, trust-boundary analysis, and attack-path modeling.\nPartner with software engineers, architects, product owners, DevOps/platform teams, cloud teams, and risk stakeholders to translate security requirements into pragmatic engineering solutions.\nDevelop and maintain secure coding standards, reusable security patterns, guardrails, reference implementations, and developer enablement materials aligned with OWASP guidance and recognized industry practices.\nServe as a technical escalation point for complex application vulnerabilities and major cybersecurity incidents; participate in an on-call rotation as required.\nMentor application security engineers and developers, contribute to technical strategy and roadmaps, and remain current with emerging attack techniques, defensive technologies, and AI-enabled software development risks.\nKnowledge, Skills, and Abilities:\nDemonstrated expertise identifying, validating, explaining, and remediating application and API vulnerabilities, including vulnerability classes represented in the OWASP Top 10 and OWASP API Security Top 10.\nAdvanced understanding of authentication, authorization, session management, cryptography, input handling, deserialization, server-side request forgery, business-logic abuse, and modern client/server attack surfaces.\nHands-on experience with SAST, DAST, IAST, SCA, API testing, secrets detection, container scanning, infrastructure-as-code scanning, and penetration-testing tools; ability to tune controls and validate tool output rather than rely solely on scanner severity.\nStrong automation and software engineering capability in Python and at least one of PowerShell, JavaScript/TypeScript, Go, Java, C#, or shell; experience consuming REST/GraphQL APIs, processing structured data, writing tests, and maintaining production-quality code.\nExperience integrating security tools with CI/CD and engineering platforms such as GitHub, GitLab, Azure DevOps, Jenkins, Jira, or comparable technologies.\nDemonstrated experience applying AI-assisted or machine-learning-enabled security tooling to source-code review, vulnerability triage, exploit-path analysis, test generation, remediation support, or finding correlation.\nExperience securing cloud-native applications on Microsoft Azure, Amazon Web Services, and/or Google Cloud Platform, including identity, secrets, workloads, APIs, containers, serverless services, and Kubernetes.\nAbility to communicate technical risk clearly to developers, architects, executives, auditors, and non-technical stakeholders, and to translate findings into prioritized engineering actions.\nAbility to lead through influence, exercise sound judgment under uncertainty, mentor others, and balance security outcomes with client and business needs.\nPrevious Experience:\nTypically requires 3 or more years of hands-on application security, product security, penetration testing, secure software development, or software security assessment experience.\nDemonstrated experience developing security automation and integrating application security controls into CI/CD workflows.\nCertifications:\nOne or more of the following certifications, or the ability to obtain a relevant certification within one year, is preferred:\nGIAC Web Application Penetration Tester (GWAPT), GIAC Certified Web Application Defender (GWEB), or comparable application security certification.\nOffensive Security Web Expert (OSWE) or comparable advanced assessment certification.\nAWS, Microsoft Azure, Google Cloud, Kubernetes, or DevSecOps certification relevant to the assigned environment.\n Education\nHigh School (HS) (Required)Work Experience\nGeneral Experience - 6 to 10 yearsCertifications\nTravel\nLess than 25% Workstyle\nHybridThe total compensation for this position includes base salary or wages, andmay include components such as additional compensation (cash or equity), discretionary bonuses, or commissions. This position is eligible for a benefits package that may include medical, dental, and vision; life insurance; critical illness insurance and accident insurance; disability benefits; retirement savings; paid time off (including vacation, holidays, and sick leave); and parental leave. Eligibility for benefits and specific offerings may vary based on position and employment status. To view more details of the benefits offered, visit Myrjbenefits.com.\nAt Raymond James our associates use five guiding behaviors (Develop, Collaborate, Decide, Deliver, Improve) to deliver on the firm's core values of client-first, integrity, independence and a conservative, long-term view. \nWe expect our associates at all levels to:\nGrow professionally and inspire others to do the same\nWork with and through others to achieve desired outcomes\nMake prompt, pragmatic choices and act with the client in mind\nTake ownership and hold themselves and others accountable for delivering results that matter\nContribute to the continuous evolution of the firm\nAt Raymond James - as part of our people-first culture, we honor, value, and respect the uniqueness, experiences, and backgrounds of all of our Associates. When associates bring their best authentic selves, our organization, clients, and communities thrive. The Company is an equal opportunity employer and makes all employment decisions on the basis of merit and business needs.\n#LI-TC1","description_format":"text","description_chars":8356,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Hybrid work","Life insurance","Parental leave"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Wealth Management & Financial Advisors"],"lifecycle":[{"event":"open","at":"2026-10-13T23:50:07Z"}],"visa":[],"liveness":{"score":21,"band":"cold","label":"Long shot","p_open":1,"p_active":0.456,"p_room":0.45,"age_days":29,"expected_fill_days":16,"reasons":["conf:26","stale_co","velocity","win:tail","comp:brand"],"computed_at":"2026-10-23T05:54:15Z"},"pay":null,"html_url":"https://alion.io/job/raymond-james-lead-application-security-engineer","json_url":"https://alion.io/job/raymond-james-lead-application-security-engineer.json","meta":{"generated_at":"2026-10-23T06:15:10Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":10194,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1768977},"rest":"https://alion.io/mcp/rest/get_company?id=1768977"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fraymond-james-lead-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fraymond-james-lead-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fraymond-james-lead-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/raymond-james-lead-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fraymond-james-lead-application-security-engineer"}]}