Lead Security Engineer - Java Backend, AI

Shape the future of security engineering—your expertise protects systems at global scale. Join a team where your technical decisions matter and career growth is celebrated.

As a Lead Security Engineer at JPMorgan Chase within the Cybersecurity and Technology Controls team, you deliver software solutions that prevent misuse and malicious behavior. You drive system design, engineering practices, and operations across services to ensure high-quality, resilient systems in private and public cloud environments. You are responsible for tamper-proof, audit-defensible methods across multiple technical areas. You work collaboratively, championing strong development practices and elevating the craft of senior engineers. You help us maintain a culture of technical ownership, intellectual curiosity, and commitment to quality.

Job responsibilities

• Design and evolve distributed systems with reliability, scalability, security, and operability across cloud environments
• Contribute hands-on code in Java and Python, setting standards for design, readability, testability, and maintainability
• Develop and maintain production-ready services using Java Spring frameworks, ensuring performance and resilience
• Uses enterprise-authorized AI capabilities within the work environment to accelerate threat modeling, vulnerability analysis synthesis, and security documentation, validating outputs and ensuring sensitive data is handled appropriately.
• Identify and remediate architectural risks, technical debt, and systemic quality gaps before production impact
• Review design proposals and code changes for correctness, resilience, and maintainability
• Own production behavior of systems end-to-end, including reliability, performance, incident response, and post-incident improvements
• Champion strong software development lifecycle practices including design reviews, testing strategy, release hygiene, and rollback planning
• Ensure systems continuously meet security, audit, and compliance expectations
• Serve as a technical mentor and role model, elevating the craft of senior engineers
• Applies reuse-first, AI-assisted practices within SDLC/toolchain routines to strengthen security testing and control validation, ensuring traceability/auditability and alignment to resiliency and security expectations.

Required qualifications, capabilities and skills

• Formal training or certification on security engineering concepts and 5+ years applied experience
• Demonstrated experience designing and operating cloud-native systems in production environments
• Strong proficiency in Java with a proven track record of delivering high-quality, maintainable code
• Experience designing and working with relational and NoSQL databases (e.g., DynamoDB, MongoDB) in production systems
• Demonstrated experience using enterprise-authorized AI capabilities within the work environment to support security engineering workflows with strong validation habits and awareness of data sensitivity.
• Ability to review and validate AI-assisted code/security recommendations before adoption, escalating uncertainty and ensuring outcomes align to security, resiliency, and auditability expectations.
• Solid understanding of software engineering best practices including automated testing, continuous integration and delivery, and release management
• Experience owning production systems including incident management, on-call responsibilities, and post-incident reviews
• Excellent written and verbal communication skills, with the ability to clearly articulate technical decisions to both technical and non-technical audiences

Preferred qualifications, capabilities and skills

• Experience working in regulated or highly controlled environments such as financial services, healthcare, or government
• Deep understanding of cloud and event-driven architectures and their security implications
• Familiarity with security compliance frameworks and audit-defensible engineering practices
• Strong grasp of operational excellence principles including monitoring, alerting, and observability strategies