Engineer, Application Security

Job Summary

Cboe Global Markets is a leading provider of market infrastructure and tradable products, delivering cutting‑edge trading, clearing, and investment solutions worldwide.

Headquarters:
Cboe HQ in the historic Old Post Office district, Chicago. The building offers modern amenities, spacious work areas, fitness center, restaurants, and easy access to public transportation.

Cboe’s Cybersecurity team needs an Application Security Engineer to partner with application and platform engineering teams, building secure containerized services on Kubernetes and advancing application security expertise.

• Partner with engineering teams to improve security of containerized services on Kubernetes.
• Participate in secure design reviews and threat modeling for new features, services, and APIs.
• Perform code‑level security reviews and provide clear, actionable remediation guidance.
• Integrate and operate security tooling in CI/CD pipelines, including SAST, dependency and container image scanning (SCA), and secret detection.
• Validate and triage security findings, distinguishing real risk from false positives and prioritizing remediation based on impact.
• Contribute to container image security practices, including secure base image usage, dependency hygiene, and attack surface reduction.
• Assist in defining and applying secure coding and deployment standards for Kubernetes workloads, APIs, and service‑to‑service communication.
• Support incident response and post‑incident reviews to analyze root causes and contribute to preventative fixes.
• Continuously grow application and Kubernetes security skills through hands‑on work and mentorship.

• 2+ years of professional experience in software engineering, application security, or a closely related role.
• Bachelor’s degree in Computer Science, Information Security, or a related field.
• Hands‑on software development experience, including building, testing, and deploying production services and comfort reading and modifying existing codebases.
• Experience building and running Docker/OCI containers and understanding of container images, layers, and runtime behavior.
• Familiarity with Kubernetes, including deploying or supporting applications and working with core primitives (pods, deployments, services, ingress) and basic security concepts (RBAC, name spaces, service accounts).
• Working knowledge of common web and API vulnerabilities (authentication/authorization issues, injection, SSRF, etc.) and secure coding practices.
• Proficiency in at least one backend programming language (Go, Java, C#, Python, Node.js) and experience with modern CI/CD workflows and Git‑based development.
• Exposure to application security tooling such as SAST, dependency or container image scanning, or secret scanning tools.
• Preferred:
  Bachelor’s degree in related field.

• Competitive salary and incentive compensation with upside for over achievement.
• Generous paid time off, including vacation, personal days, sick days, and annual community service days.
• Health, dental, and vision benefits with telemedicine and mental health services.
• 2:1 401(k) match up to 8% upon hire.
• Employee Stock Purchase Plan with tax savings.
• Discounted training and education opportunities.
• Paid parental leave and fertility benefits.
• Volunteer opportunities and charitable giving match.

$102,850 – $133,100 annually, with additional incentive and equity potential.

Cboe Global Markets is an Equal Opportunity Employer and does not discriminate based on race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, genetic information, or veteran status.

This position is not eligible for visa sponsorship. Candidates must be legally authorized to work in the United States without the need for employer sponsorship now or in the future.