Charles Schwab

Application Security Engineer

Hybrid

Orlando, FLPosted 1 week agoUSD $110,000.00 - $135,000.00 / YearWebsite

Apply on LinkedIn →

At a Glance

PythonOWASPNISTPen TestingThreat ModelingCode Review

About This Role

The Schwab Application Security team, operating under the leadership of the Chief Information Security Officer (CISO), is responsible for protecting Schwab's information assets in support of business objectives and in alignment with corporate policies. As a core function within Cybersecurity Services, the Application Security team leads the establishment and ongoing evolution of Schwab's Secure Software Development Program. This includes the creation and implementation of software security policies and best practices, providing security architecture guidance, conducting software security scanning and penetration testing, and educating developers and testers on secure coding practices. The Software Security Engineer plays a key role in safeguarding software assets by strengthening the development process, enhancing security controls, and reducing defects and vulnerabilities in production environments. Successful candidates will have prior engineering experience within a Software Security Assurance or Application Security team and a proven ability to partner effectively with development teams to balance security requirements with innovation. They will demonstrate strong analytical skills, including the ability to interpret large volumes of distributed data and translate it into clear, actionable insights. Candidates should also have experience working with a range of application security tools, including Software Composition Analysis (SCA), Static Application Security Testing (SAST), and secrets management solutions. In addition, candidates will bring solid application engineering experience and a strong understanding of common application vulnerabilities, attack vectors, and remediation strategies. They should be familiar with secure software design principles and industry best practices for integrating security into the software development lifecycle. Experience with application security testing tools, such as Fortify, and their integration into agile development environments is expected. Candidates should have familiarity with recognized industry frameworks and standards such as OWASP, CIS, and NIST. A minimum of two years of experience working with static analysis or threat modeling tools is expected, along with experience implementing and scaling enterprise application security tools, services, and controls. Finally, candidates must demonstrate a strong understanding of secure coding practices, code review processes, threat modeling, security requirements analysis, and architectural risk assessment.

Responsibilities

Strengthen the development process and enhance security controls
Reduce defects and vulnerabilities in production environments
Conduct software security scanning and penetration testing
Provide security architecture guidance
Educate developers and testers on secure coding practices
Partner with development teams to balance security requirements with innovation
Interpret large volumes of distributed data and translate into actionable insights
Implement and scale enterprise application security tools, services, and controls

Requirements

SCASASTFortifyOWASPNISTPython

Prior engineering experience within a Software Security Assurance or Application Security team
Strong analytical skills
Experience with Software Composition Analysis (SCA)
Experience with Static Application Security Testing (SAST)
Experience with secrets management solutions
Solid application engineering experience
Understanding of common application vulnerabilities and attack vectors
Understanding of remediation strategies
Familiarity with secure software design principles
Experience with Fortify
Experience integrating security tools into agile development environments
Familiarity with OWASP, CIS, and NIST frameworks
Minimum two years of experience with static analysis or threat modeling tools
Strong understanding of secure coding practices
Code review process knowledge
Threat modeling expertise
Security requirements analysis skills
Architectural risk assessment capability
Strong proficiency in Python-based automation
REST API integration experience
Custom CodeQL Query Development
GitHub Advanced Security (GHAS) experience
GitHub Actions expertise
SARIF specification knowledge
Enterprise Git workflow experience
Application security vulnerability engineering knowledge
Multi-repository architecture experience
Enterprise package registry knowledge
Technical documentation and Architecture Decision Records (ADRs) writing skills

Benefits & Perks

401(k) with company match

Employee stock purchase plan

Paid time for vacation

Paid time for volunteering

28-day sabbatical after every 5 years of service for eligible positions

Paid parental leave

Family building benefits

Tuition reimbursement

Health, dental, and vision insurance

Hybrid work arrangement

Workplace flexibility

About Charles Schwab

Charles Schwab Corporation is a leading financial services firm that has transformed the investment landscape by making financial markets more accessible. Founded in 1971 in San Francisco, the company has grown to become the largest publicly traded investment services firm in the U.S., managing approximately $7.8 trillion in client assets across 32.5 million accounts. Schwab offers a wide range of services, including discount brokerage, online trading, and custodial services for independent investment advisors. The firm is known for its low commission rates and has eliminated commissions on online stock, ETF, and options trades. It also provides a comprehensive mutual funds marketplace and full-service banking options. Schwab primarily serves individual retail investors and financial professionals, focusing on removing barriers to investing and advocating for everyday people seeking to grow their wealth.

Industry

financial services

Employees

33,000

4241 engineers

Revenue

$26B

Website

Visit →

Security at Charles Schwab

Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.

3 Intel Signals

Security Philosophy

“Charles Schwab's AppSec mission is to "safeguard information and cultivate client trust, empowering people to feel secure in every interaction."They operate within Schwab's Secure Application Development Standard and leverage AppSec services to "shift left"and continuously improve security posture. Their risk philosophy involves applying OWASP Top 10 knowledge to identify common vulnerability categories and advising teams on secure patterns. A stated goal is to contribute to the continuous improvement of application security processes and tooling. Information regarding gaps and contradictions in their philosophy is not publicly available.”

Security Team

The AppSec team is part of Schwab Cybersecurity Services (SCS), which is responsible for securing access, protecting data, and safeguarding applications, endpoints, and the cloud. Bashar Abouseido is a key public-facing leader, serving as Senior Vice President, Chief Information Security Officer. He has been quoted stating that "Google is transforming security operations and enabling our vision to stay proactive in responding to cyber threats."A precise team size estimate is not publicly available. As of, there is one active AppSec job posting (Application Security Analyst) on schwabjobs.com. Common skill/tool patterns from job postings include exposure to OWASP Top 10 concepts, hands-on familiarity with DAST workflows and tools, API Security fundamentals, programming fundamentals in Java and .NET, and familiarity with AppSec tooling including common DAST capabilities and BURP Suite. Information regarding other gaps and contradictions is not publicly available.

Key Initiatives

There is no evidence found for a Security Champions Program. The team supports "shift-left"practices by integrating AppSec tooling into build pipelines and promoting developer experience best practices. Their vulnerability management process involves performing and supporting DAST for web and API-based services (intake), and partnering with developers to reproduce findings, review fixes, and validate remediation (triage/remediation). They operate within Schwab's Secure Application Development Standard as part of their Secure SDLC Artifacts. A recent initiative (within the last 6 months) highlights that Google's automated response capabilities have "dramatically reduced"the financial services company's investigation resolution time. Information regarding other gaps and contradictions is not publicly available.

Preparing for an AppSec interview?

Get the weekly briefing 2,000+ security pros trust.

Interested in this role?

Apply on LinkedIn