Application Security Architect - AI Harness
Edward Jones
Team Overview:The Application Security Architect, Agentic Secure Code Architect is a hands-on architecture-focused IC responsible for designing, integrating, maintaining, and improving a CI/CD-integrated AI evaluation harness used to assess application and infrastructure source code for security vulnerabilities and insecure-design practices. This role combines AppSec, DevSecOps, AI engineering, secure SDLC governance, and financial-services compliance, with strong emphasis on source-code protection, enterprise controls governance, repeatability, auditability, measurable risk reduction, and developer trust.
What You'll Do:
- Architect the CI/CD-integrated AI secure-code evaluation harness as a hands-on IC for source code repositories and Secure SDLC lifecycles.
- Integrate evaluation workflows with pipeline tooling and AppSec reporting platforms.
- Design AI-assisted secure code review methods that complement SAST, SCA, DAST, secrets scanning, IaC scanning, threat modeling, security testing, and manual assessments.
- Maintain benchmarks, golden test cases, prompt/model versions, retrieval configurations, scoring criteria, and regression tests for AI-generated findings.
- Govern approved vendor and frontier AI models, including selection, routing, fallback patterns, accuracy, explainability, cost, and data-protection trade-offs.
- Define safeguards for proprietary production code, including access controls, approved model endpoints, minimization, retention limits, secure logging, and evidence handling.
- Route validated findings into developer workflows with actionable remediation guidance and feedback loops to reduce false positives and improve adoption.
- Define metrics and control evidence aligned to internal governance processes, financial services industries authorities, and cyber security frameworks (NIST SSDF, NIST CSF 2.0, NYDFS, FINRA, SOX ITGC, FFIEC, GLBA).