Lead Application Security - DevSecOps & AI-Driven Software Assurance

Introduction

Since 1973, East West Bank has served as a pathway to success. With over 110 locations across the U.S. and Asia, we are the premier financial bridge between the East and West. Our teams of experienced, multi-cultural professionals help guide businesses and community members on both sides of the Pacific looking to explore new markets and create new opportunities, and our sustained growth and expertise in industries like real estate, entertainment and media, private equity and venture capital, and high-tech help build sustainable businesses and expand our associates’ potential for career advancement.

Headquartered in California, East West Bank (Nasdaq: EWBC) is a top-performing commercial bank with a strong foundation, an enterprising spirit and a commitment to absolute integrity. East West Bank gives people the confidence to reach further.

The Senior Cyber Security Engineer will lead and execute security initiatives across the application lifecycle, integrating security into Dev Ops pipelines, managing vulnerability assessments, and coordinating penetration testing efforts. This role also extends into advanced software assurance, including third-party software analysis, binary-level inspection, and application trust validation, ensuring that both internally developed and externally sourced applications meet the bank’s security standards prior to execution within the enterprise environment.

• Embed security controls into CI/CD pipelines using Git Hub workflows and automation tools.
• Collaborate with development teams to implement secure coding practices and threat modeling during design and development phases.
• Manage Git Hub Advanced Security configurations, including secret scanning, push protection, and impact analysis.

• Conduct Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) using approved tools (e.g.,CodeQL,Dependabot,,OWASP ZAP).
• Perform manual and automated code reviews toidentifyvulnerabilities and ensure remediation through code fixes or configuration changes.
• Maintainaccuratemapping of applications to Git Hub repositories to support vulnerability tracking and reporting.

• Perform security analysis of third-party software, including both source code review and compiled binary analysis where source is not available.
• Conduct binary decomposition and reverse engineering techniques, as appropriate, to evaluate software behavior and identify embedded risks.
• Support the establishment and execution of a software trust and reputation framework, enabling secure decision-making for application onboarding and whitelisting within the enterprise environment.
• Analyze open-source and Git Hub-hosted code, including dependencies and contribution risk.
• Partner with App Sec leadership to support application security activities and formalize secure software approval processes.

• Conduct API security assessments and integrate monitoring tools to protect application endpoints.
• Support WAF policy management and application-layer threat monitoring.

• Threat Intelligence Integration
• Integrate threat intelligence insights into software risk assessments, including monitoring for newly disclosed vulnerabilities or exposures in previously approved software.
• Reassess software trust posture when threat conditions change, ensuring continuous validation of approved applications.

• Integrate threat intelligence insights into software risk assessments, including monitoring for newly disclosed vulnerabilities or exposures in…