Cboe’s Cybersecurity team is seeking an Application Security Engineer to help strengthen the security posture of containerized services running on Kubernetes. In this role, you will collaborate closely with application and platform engineering to design, build, and deploy secure services, while applying security practices through established processes and tooling integrated into CI/CD.
This position focuses on hands-on application and Kubernetes security work, including secure design reviews, code-level security assessments, and the validation and triage of security findings. You will also support incident response and contribute to post-incident improvements alongside senior engineers.
What you will do
- Partner with engineering teams to enhance security for Kubernetes-based containerized services
- Participate in secure design reviews and threat modeling for new features, services, and APIs
- Conduct code-level security reviews and provide clear, actionable remediation guidance to developers
- Integrate and operate security tooling in CI/CD pipelines, including SAST, dependency and container image scanning (SCA), and secret detection
- Validate and triage security findings by distinguishing true risk from false positives and prioritizing remediation based on impact
- Contribute to container image security practices, including secure base image usage, dependency hygiene, and attack surface reduction
- Help define and apply secure coding and deployment standards for Kubernetes workloads, APIs, and service-to-service communication
- Support incident response and post-incident reviews by analyzing root causes and contributing preventative fixes
- Continuously grow application and Kubernetes security skills through hands-on work and mentorship from senior team members
Requirements
- 2+ years of professional experience in software engineering, application security, or a closely related role
- Bachelor’s degree in Computer Science, Information Security, or a related field
- Hands-on software development experience building, testing, and deploying production services, with comfort reading and modifying existing codebases
- Experience building and running Docker/OCI containers, including understanding container images, layers, and runtime behavior
- Familiarity with Kubernetes, including deploying or supporting applications and working with core primitives (pods, deployments, services, ingress) and basic security concepts (RBAC, namespaces, service accounts)
- Working knowledge of common web and API vulnerabilities (authentication/authorization issues, injection, SSRF, etc.) and secure coding practices
- Proficiency in at least one backend programming language (Go, Java, C#, Python, or Node.js) and experience with modern CI/CD workflows and Git-based development
- Exposure to application security tooling such as SAST, dependency or container image scanning, or secret scanning tools
- Bachelor’s degree preferred
Technologies
- Kubernetes, Docker, OCI
- SAST, SCA, secret detection
- RBAC, namespaces, service accounts
- Pods, deployments, services, ingress
- Go, Java, C#, Python, Node.js
- CI/CD, Git
Compensation and benefits
- Fair and competitive salary and incentive compensation packages with an upside for overachievement
- Generous paid time off, including vacation, personal days, sick days, and annual community service days
- Health, dental and vision benefits, including access to telemedicine and mental health services
- 2:1 401(k) match, up to 8% match immediately upon hire
- Discounted Employee Stock Purchase Plan
- Tax Savings Accounts for health, dependent and transportation
- Employee referral bonus program
- Volunteer opportunities to help you give back to your communities
- Paid Tuition assistance and education opportunities
- Generous charitable giving company match
- Paid parental leave and fertility benefits
Location: Chicago, IL (onsite). Salary: USD 102,850 - 133,100 per yearly. Reporting line: Manager, Cybersecurity.
US salary ranges: The anticipated base salary range for this role is $102,850-$133,100, with actual compensation determined by job-related factors such as skills, relevant experience, education, internal alignment, and location. This role may also be eligible for annual incentive compensation and, where applicable, participation in Cboe’s long-term equity programs.
