Director, Application Security

#WeAreTradeStation

Remote Position - must reside in Florida, Texas, Illinois, New York, New Jersey, Colorado, Idaho, Massachusetts, Michigan, Minnesota, Missouri, North Carolina, South Carolina, Utah or Virgina

Who We Are:

TradeStation is the home of those born to trade. As an online brokerage firm and trading ecosystem, we are focused on delivering the ultimate trading experience for active traders and institutions. We continuously push the boundaries of what's possible, encourage out-of-the-box thinking, and relentlessly search for like-minded innovators.

At TradeStation, we are building an AI-First culture. We expect team members to embrace AI as a core part of their daily workflow, whether that’s using AI to accelerate development, enhance decision-making, improve client outcomes, or streamline internal processes. We hire, grow, and promote people who can harness AI responsibly and creatively. We treat AI as a partner in problem-solving, not just a tool; following our governance standards to ensure AI is used ethically, securely, and transparently. If you join us, you’re joining a culture where AI is how we work.

Are you ready to make yourself at home?

What We Are Looking For:

We are looking for a Director of Application Security who will develop and manage TradeStation’s application security program.

What You’ll Be Doing:

Define and deliver secure development policies and standards

Advise Development, Engineering and other teams on all areas associated with security within applications such as secure coding practices, vulnerability identification and remediation, baseline control standards, etc.

Application security testing and remediation coordination, including static, dynamic, penetration testing, and more

Define and deliver application security metrics designed to communicate application security risk posture to executives and others

Develop and deliver secure development training designed to ensure that development team employees understand how to build applications securely. Track compliance with the training program and ensure that it delivers measurable risk reducing results

Continuously communicate application risk posture to the technology management team, development teams, the CISO and others

Ensure all TradeStation applications maintain controls designed to adequately protect sensitive information such as personal and customer information

Serve as a trusted advisor to development managers and teams on all areas related to application security and best practices

Identify opportunities for improvement in application resiliency

Remain continuously up to date on the latest cyber security threats and countermeasures, applying and sharing that knowledge broadly

Lead application risk assessment initiatives to identify potential security risks and methods for improvement

Track identified application risk issues and provide regular status updates to the Security team and CISO

Collaborate closely with the CISO and his/her other direct reports to shape the overall security posture

Assist with other security related initiatives

The Skills You Bring:

Knowledge and experience with industry accepted secure application build practices such as OWASP, ISO, ITIL, and others

Solid understanding of deploying applications in a cloud environment securely (AWS, Azure, etc), as well as “infrastructure as code”, containerized applications, etc.

Skills using static, dynamic, and other application security testing tools and third parties such as, BURP Suite, Checkmarx, Black Duck, and others

Experience using web application firewall technologies

Strong ability to leverage artificial intelligence to enhance productivity, testing, etc, as well as protect against AI-based threats

Strong knowledge of encryption, authentication methods, and application and database management and entitlements

Understanding of risks associated with the use of open-source modules and code

Must have excellent verbal and written communication skills

Must be highly organized

Strong analytical and problem-solving skills

Must be able to multitask and prioritize work in a quickly changing business environment with continuously shifting priorities

Solid understanding of information security and risk management principles

Understanding project management practices and development workflows.

Must be knowledgeable in software development practices

Must have worked directly with application developers to identify, validate, triage, and remediate application security vulnerabilities

Knowledge and experience using IT and development processes and control frameworks such as OWASP, COBIT, ISO, ITIL, and others preferred

Minimum Qualifications:

At least 7 years of progressive information security work experience

At least 5 years working specifically with application security

Bachelor's degree in Information Technology, Computer Engineering, Accounting or related field of study; or any equivalent combination of relevant background, skills and experience

Ability to travel to company offices, including international offices, or other locations occasionally as needed for meetings, training, to perform work tasks, etc.

Desired Qualifications:

One or more of the following certifications strongly preferred:

CISSP (and/or other ISC2 certifications)

CISM, CISA, CRISC (and/or other ISACA certifications

SANS GIAC certifications

CEH or other penetration testing certifications

PMP or other project management certifications

Other industry recognized certifications or accreditations

What We Offer:

Collaborative work environment

Competitive Salaries

Yearly bonus

Comprehensive benefits for you and your family starting Day 1

Unlimited Paid Time Off

Flexible working environment

TradeStation Account employee benefits, as well as full access to trading education materials

Pay Range (US) $180-210K (Countries outside of the US have differing ranges in accordance with local labor markets)

TradeStation provides equal employment opportunities to current and prospective employees, without regard to race, color, religion, sex, national origin, ancestry, sexual orientation, age, pregnancy, disability, handicap, citizenship, veteran or marital status, or any other legally recognized status entitled to protection under federal, state, or local anti-discrimination laws.

#LI-Remote