Sr Application Security Engineer

Join a team building security into how software is delivered at TIAA. This on-site Senior Application Security Engineer role in Dallas, TX focuses on practical application security automation, CI/CD integration, and tool administration, with a strong emphasis on partnering with developers and communicating technical risk clearly to engineers, product owners, and leadership.

The role supports scanning and audit-ready documentation, helps shape the AppSec roadmap through threat modeling and security finding standards, and advances secure AI-assisted development with guardrails and human review.

What you’ll do

• Help set the application security strategy through threat modeling, zero-day response considerations, and quality standards for security findings aligned to the evolving threat landscape.
• Build and integrate security controls into CI/CD pipelines, including automation that supports microservices, APIs, and developer-friendly workflows.
• Support AI-assisted development and AI-enabled applications, using guardrails and human review for triage, enrichment, and remediation.
• Research and run proof-of-concept evaluations for security tools, benchmarking accuracy, coverage, and developer experience to keep the program effective and cost-efficient.
• Act as a trusted advisor to development teams by partnering on priorities and helping teams fix findings without slowing delivery.
• Host office hours, coach teams on secure coding, and collect developer feedback to improve tools and processes.
• Explain technical risk in clear, plain terms for developers, product owners, and leadership.
• Keep the program healthy through application onboarding, ad hoc scanning, tool administration, SLA-based reporting, and audit-ready documentation.

Qualifications

• 3+ years of experience in application security, security engineering, or software engineering with a security focus.
• 3+ years with AppSec tooling including SAST, SCA, DAST/IAST, or secrets detection.
• 3+ years with Java and/or Spring Boot, building microservices and/or REST APIs.
• 2+ years integrating security tools into CI/CD pipelines.
• Experience with scripting and/or automation (Python, Bash, or similar).

Education: University (Degree) Preferred

Helpful experience

• 5+ years in application security or security engineering with a security focus.
• Working knowledge of the OWASP Top 10 and secure coding practices.
• Experience enabling developers through office hours, training, secure coding guidance, or champions programs.
• Experience partnering directly with software developers to resolve security issues, including explaining risk, recommending practical fixes, and following through to closure.
• Strong written and verbal communication across developers, product owners, and executives.
• Ability to influence without authority, resolve competing priorities, and build consensus.
• Experience collecting developer feedback to improve tools, processes, or documentation.
• 2+ years with penetration test findings, threat modeling, or zero-day and critical vulnerability response.
• 2+ years building or evaluating security tooling with proof-of-concept testing, including business cases.
• Experience migrating or administering security platforms.
• 2+ years developing or interpreting security metrics and dashboards for technical and non-technical stakeholders.
• Experience in cloud-native environments (APIs, containers, IaC, CI/CD) and with software supply chain security.
• Experience in financial services or another regulated environment with audit and governance processes.
• Experience reviewing AI-generated code, or securing AI coding assistants and agent/MCP integrations.
• Experience building LLM-based security automation with guardrails, including judgment on validating AI output and protecting sensitive data.

Compensation and work details

• Location: Dallas, TX (onsite)
• Base pay range: $102,000/yr - $122,000/yr
• Work experience: 3+ Years Required; 5+ Years Preferred
• Career level: 7IC
• Physical requirements: Sedentary Work

Anticipated posting end date: 2026-11-10

Benefits

• Superior retirement program
• Highly competitive health, wellness and work life offerings
• Participation in an incentive program linked to performance (for example, annual discretionary incentive programs, non-annual sales incentive plans, or other non-annual incentive plans)