This role pays less than
88%
of similar roles. Most pay
$149,922–$208,800
— the shaded band above.
At the midpoint, this role pays about
$134k
versus about
$179k
for comparable roles.
Based on 240 similar postings.
Employer
About LPL Financial
LPL Financial is the largest independent broker-dealer in the United States, providing brokerage and investment advisory services to independent financial advisors and financial institutions. Industry: Financial Services & Wealth Management
LPL Financial currently has
59 open roles
on FindRole.
Listed pay typically runs
$140,959–$234,882
across 54 roles with salary data.
As a member of the Information Security team, the Sr. Application Security Engineer will develop, mature, and sustain the company’s application security program. This role involves serving as a subject matter expert for web applications, mobile applications, databases, APIs, and containers while maintaining testing platforms and developing integrations with automation tools. The engineer will collaborate with development teams to review scan results, track metrics, and mentor others on secure coding practices. Key responsibilities include managing the security of critical investor and advisor applications within a DevSecOps framework. Required skills include experience with OWASP Top 10 risks, CI/CD pipelines, and tools like Synopsys, BlackDuck, J-Frog, PrismaCloud, Burp Suite, and Postman. The role requires proficiency in C#, Java, and web technologies including HTML, CSS, JS, React, Angular, and REST to secure the firm's financial technology infrastructure.
Act as a subject matter expert for web applications, mobile apps, databases, APIs, and containers.
Support and maintain application security testing platforms and develop integrations with automation tools.
Review scan results with development teams to identify false positives and evaluate mitigation strategies.
Produce and track key application security metrics to measure program effectiveness.
Mentor and educate product development and quality engineers on secure coding practices.
Monitor CVEs and industry developments to provide input for continuous security improvements.
Collaborate with internal audit, governance, and compliance teams on specific security projects.
What we're looking for
5+ years of experience in application security.
5+ years of experience performing manual testing of APIs and web applications to identify/validate vulnerabilities.
5+ years of experience developing and maintaining enterprise security libraries, components, best practices checklists, and scan profiles for automated analysis.
5+ years of experience performing application security risk evaluation and reviewing/analyzing vulnerability scan results.
Knowledge of OWASP Top 10 risks, secure coding best practices, secure SDLC, and DevSecOps methodologies.
Bachelor’s Degree or equivalent in Information Security, Engineering, or Computer Science (preferred).
Experience with specific tools like Synopsys, BlackDuck, J-Frog, PrismaCloud, Burp Suite, Postman, and C#, Java, or web technologies (preferred).