Be an Early Applicant
At CDW, our purpose is to make technology work so people can do great things.
The Role
Leads enterprise application security through secure code reviews, threat modeling, architecture assessments, CI/CD security controls, secure coding standards, API protections, WAF tuning, and software supply chain security. Partners with engineering, DevOps, platform, and SRE teams to remediate risks, automate controls, secure AI-enabled applications, and improve organization-wide security practices. Serves as a principal technical advisor and mentor while defining scalable guardrails, playbooks, metrics, and reference architectures.
Summary Generated by Built In
Description
Job Summary
Join CDW and help secure the software, platforms, and services that support more than 250,000 customers across enterprise, government, education, and healthcare. As part of CDW's Global Information Security team, you will help shape how application security is embedded into engineering at scale- partnering across development, platform engineering, SRE, and DevOps to reduce risk while enabling delivery. As a Principal Application Security Engineer, you will serve as a senior technical leader and trusted advisor who helps influence secure engineering practices across the enterprise. You will bring deep hands-on application security expertise while enabling teams to adopt scalable patterns, controls, and guardrails across applications, APIs, and software delivery pipelines. This role is ideal for someone who can move fluidly between strategy and execution- shaping direction, building trust through influence, and diving into technical detail when needed.
What you will do
* Lead high-impact secure code reviews, threat models, and secure design assessments for applications, APIs, and shared services- translating technical risk into clear guidance for engineers, technical leaders, and business stakeholders.
* Drive the design, integration, and continuous improvement of application security controls across CI/CD platforms, workflows, and environments in close partnership with engineering, DevOps, and platform teams.
* Identify control gaps, coverage weaknesses, and sources of engineering friction across the software delivery lifecycle, and drive practical remediation through automation, platform improvements, and secure-by-design patterns.
* Define, advocate for, and build secure coding standards, reference architectures, playbooks, tooling, and automations that scale application security without slowing delivery.
* Serve as a senior technical partner to engineering teams by influencing design decisions, guiding remediation strategy, and helping embed security into how software is built and deployed.
* Advance CDW's approach to securing AI-enabled development and applications by evaluating emerging risks, defining practical guardrails, and promoting responsible use of AI as a force multiplier for engineering and security outcomes.
* Provide deep subject matter expertise in API security, including authentication and authorization models, protections, monitoring, and secure integration patterns across modern application ecosystems.
* Partner with web and platform teams to design, deploy, and tune application-layer protections such as WAF rules and policies.
What we expect of you
* 10+ years of experience in Application Security Engineering, including hands-on work embedding security into software design, development, and delivery practices.
* Deep, hands-on expertise in secure application architecture and design, secure coding practices, code-level vulnerability analysis, and threat modeling.
* Background in software engineering, application development, or architecture, with the ability to engage credibly at the design, code, build, or runtime levels.
* Strong command of authentication, authorization, session management, API security, secrets management, and common application vulnerabilities and exploit patterns, including OWASP Top 10 classes, injection, deserialization, SSRF, insecure design, access control issues, and dependency risk.
* Hands-on experience securing applications built in one or more modern technology stacks such as C#, Java, Python, JavaScript or TypeScript, Go, or similar.
* Strong experience integrating security into CI/CD pipelines, developer workflows, and engineering platforms, including technologies such as SAST, SCA, DAST, IaC scanning, container security, API security testing, and software supply chain security controls.
* Ability to independently investigate complex technical problems, identify root causes, and drive practical remediation while moving fluidly between enterprise patterns and code-level detail.
* Strong written and verbal communication skills with the ability to influence engineers, platform teams, and senior stakeholders through technical credibility, sound judgment, and partnership.
* Strong sense of ownership and accountability, with the ability to balance hands-on technical execution with mentoring others, raising standards, and driving organization-wide improvements in application security.
* Experience defining standards, playbooks, secure reference architectures, or scalable practices that can be adopted broadly across engineering organizations.
* Experience with software supply chain security, including dependency risk management, build pipeline hardening, SBOM, artifact integrity, provenance, and package governance, a plus.
* Hands-on experience with AI security, including securing AI-enabled applications or advising engineering teams on the secure use of AI or LLM-based capabilities, a plus.
* Familiarity with Zero Trust, secure platform engineering, and policy-as-code approaches, a plus.
* Prior experience serving as an Application Security Champion, Security Champion, embedded security lead, principal engineer, or senior engineer responsible for driving security within product or application teams, a plus.
* Experience with runtime application protection, exploit prevention, threat detection technologies, and abuse case analysis, a plus.
* Experience influencing secure development practices across decentralized or federated engineering organizations, including driving adoption through partnership, standards, and enablement, a plus.
* Experience defining and using application security metrics, maturity measures, or risk-based reporting to prioritize improvements and demonstrate impact, a plus.
* Experience designing security controls for cloud-native and distributed systems running in Azure, AWS, or GCP, a plus.
* Experience designing, deploying, or tuning Akamai protections, a plus.
* Experience with reviewing and securing IaC (Terraform or similar), a plus. Pay range: $172,000 - 240,000 depending on experience and skill set. Annual bonus target 15% subject to terms and conditions of plan. Benefits overview: https://cdw.benefit-info.com/ Salary ranges may be subject to geographic differentials.
* CDW is committed to being an AI-fluent organization
* We're looking for people who bring curiosity, a learner's mindset, and a willingness to engage with ever-evolving technology and tools. We value adopting AI as a partner, openness to experimentation, and a shared interest in learning together on AI. Our goal is to create a culture where AI enhances- not replaces- human creativity and decision-making. You don't need to be an expert today; what matters is your readiness to explore, adapt, and grow with us as we integrate AI responsibly and effectively into our work.Additionally, CDW is committed to fostering an equitable, transparent, and respectful hiring process for all applicants. During our application process, our goal is to understand your experience, strengths, skills, and qualifications. As an AI forward company, we see AI not just as a tool, but as a catalyst for new ways of thinking, creating, and communicating. We encourage candidates to embrace an AI mindset, one that's curious, adaptive, and ready to explore what's possible. We welcome thoughtful use of AI to expand your perspective and elevate how you share your story, while ensuring your application remains rooted in your own background, judgment, and voice.
* About Us
* CDW is a Fortune 500 technology solutions provider that helps businesses, government, education, and healthcare organizations achieve what's possible through technology. What makes CDW different isn't just what we do- it's how we do it. At CDW we act as one- building trust, speaking candidly, and working together to achieve more. We play to win- focusing on what matters most and delivering for our customers. And we think forward- staying curious, moving fast, and continuously learning. We believe meaningful work happens when people feel supported, heard, and empowered to contribute. That's why we think of ourselves as coworkers, not just employees- working together to solve complex challenges and deliver real impact for our customers and communities. As a full-stack, full-lifecycle technology partner, CDW brings deep expertise, strong relationships, and broad industry knowledge to help turn ideas into outcomes. When you join CDW, you become part of a collaborative environment where your work matters, your growth is supported, and your contributions help shape what's next. Together, we deliver the full promise of what technology can do.
* Together, we Make Amazing Happen.
* CDW is an equal opportunity employer. All qualified applicants will receive consideration for employment without regards to race, color, religion, sex, sexual orientation, gender identity, national origin, disability status, protected veteran status or any other basis prohibited by state and local law.
Job Summary
Join CDW and help secure the software, platforms, and services that support more than 250,000 customers across enterprise, government, education, and healthcare. As part of CDW's Global Information Security team, you will help shape how application security is embedded into engineering at scale- partnering across development, platform engineering, SRE, and DevOps to reduce risk while enabling delivery. As a Principal Application Security Engineer, you will serve as a senior technical leader and trusted advisor who helps influence secure engineering practices across the enterprise. You will bring deep hands-on application security expertise while enabling teams to adopt scalable patterns, controls, and guardrails across applications, APIs, and software delivery pipelines. This role is ideal for someone who can move fluidly between strategy and execution- shaping direction, building trust through influence, and diving into technical detail when needed.
What you will do
* Lead high-impact secure code reviews, threat models, and secure design assessments for applications, APIs, and shared services- translating technical risk into clear guidance for engineers, technical leaders, and business stakeholders.
* Drive the design, integration, and continuous improvement of application security controls across CI/CD platforms, workflows, and environments in close partnership with engineering, DevOps, and platform teams.
* Identify control gaps, coverage weaknesses, and sources of engineering friction across the software delivery lifecycle, and drive practical remediation through automation, platform improvements, and secure-by-design patterns.
* Define, advocate for, and build secure coding standards, reference architectures, playbooks, tooling, and automations that scale application security without slowing delivery.
* Serve as a senior technical partner to engineering teams by influencing design decisions, guiding remediation strategy, and helping embed security into how software is built and deployed.
* Advance CDW's approach to securing AI-enabled development and applications by evaluating emerging risks, defining practical guardrails, and promoting responsible use of AI as a force multiplier for engineering and security outcomes.
* Provide deep subject matter expertise in API security, including authentication and authorization models, protections, monitoring, and secure integration patterns across modern application ecosystems.
* Partner with web and platform teams to design, deploy, and tune application-layer protections such as WAF rules and policies.
What we expect of you
* 10+ years of experience in Application Security Engineering, including hands-on work embedding security into software design, development, and delivery practices.
* Deep, hands-on expertise in secure application architecture and design, secure coding practices, code-level vulnerability analysis, and threat modeling.
* Background in software engineering, application development, or architecture, with the ability to engage credibly at the design, code, build, or runtime levels.
* Strong command of authentication, authorization, session management, API security, secrets management, and common application vulnerabilities and exploit patterns, including OWASP Top 10 classes, injection, deserialization, SSRF, insecure design, access control issues, and dependency risk.
* Hands-on experience securing applications built in one or more modern technology stacks such as C#, Java, Python, JavaScript or TypeScript, Go, or similar.
* Strong experience integrating security into CI/CD pipelines, developer workflows, and engineering platforms, including technologies such as SAST, SCA, DAST, IaC scanning, container security, API security testing, and software supply chain security controls.
* Ability to independently investigate complex technical problems, identify root causes, and drive practical remediation while moving fluidly between enterprise patterns and code-level detail.
* Strong written and verbal communication skills with the ability to influence engineers, platform teams, and senior stakeholders through technical credibility, sound judgment, and partnership.
* Strong sense of ownership and accountability, with the ability to balance hands-on technical execution with mentoring others, raising standards, and driving organization-wide improvements in application security.
* Experience defining standards, playbooks, secure reference architectures, or scalable practices that can be adopted broadly across engineering organizations.
* Experience with software supply chain security, including dependency risk management, build pipeline hardening, SBOM, artifact integrity, provenance, and package governance, a plus.
* Hands-on experience with AI security, including securing AI-enabled applications or advising engineering teams on the secure use of AI or LLM-based capabilities, a plus.
* Familiarity with Zero Trust, secure platform engineering, and policy-as-code approaches, a plus.
* Prior experience serving as an Application Security Champion, Security Champion, embedded security lead, principal engineer, or senior engineer responsible for driving security within product or application teams, a plus.
* Experience with runtime application protection, exploit prevention, threat detection technologies, and abuse case analysis, a plus.
* Experience influencing secure development practices across decentralized or federated engineering organizations, including driving adoption through partnership, standards, and enablement, a plus.
* Experience defining and using application security metrics, maturity measures, or risk-based reporting to prioritize improvements and demonstrate impact, a plus.
* Experience designing security controls for cloud-native and distributed systems running in Azure, AWS, or GCP, a plus.
* Experience designing, deploying, or tuning Akamai protections, a plus.
* Experience with reviewing and securing IaC (Terraform or similar), a plus. Pay range: $172,000 - 240,000 depending on experience and skill set. Annual bonus target 15% subject to terms and conditions of plan. Benefits overview: https://cdw.benefit-info.com/ Salary ranges may be subject to geographic differentials.
* CDW is committed to being an AI-fluent organization
* We're looking for people who bring curiosity, a learner's mindset, and a willingness to engage with ever-evolving technology and tools. We value adopting AI as a partner, openness to experimentation, and a shared interest in learning together on AI. Our goal is to create a culture where AI enhances- not replaces- human creativity and decision-making. You don't need to be an expert today; what matters is your readiness to explore, adapt, and grow with us as we integrate AI responsibly and effectively into our work.Additionally, CDW is committed to fostering an equitable, transparent, and respectful hiring process for all applicants. During our application process, our goal is to understand your experience, strengths, skills, and qualifications. As an AI forward company, we see AI not just as a tool, but as a catalyst for new ways of thinking, creating, and communicating. We encourage candidates to embrace an AI mindset, one that's curious, adaptive, and ready to explore what's possible. We welcome thoughtful use of AI to expand your perspective and elevate how you share your story, while ensuring your application remains rooted in your own background, judgment, and voice.
* About Us
* CDW is a Fortune 500 technology solutions provider that helps businesses, government, education, and healthcare organizations achieve what's possible through technology. What makes CDW different isn't just what we do- it's how we do it. At CDW we act as one- building trust, speaking candidly, and working together to achieve more. We play to win- focusing on what matters most and delivering for our customers. And we think forward- staying curious, moving fast, and continuously learning. We believe meaningful work happens when people feel supported, heard, and empowered to contribute. That's why we think of ourselves as coworkers, not just employees- working together to solve complex challenges and deliver real impact for our customers and communities. As a full-stack, full-lifecycle technology partner, CDW brings deep expertise, strong relationships, and broad industry knowledge to help turn ideas into outcomes. When you join CDW, you become part of a collaborative environment where your work matters, your growth is supported, and your contributions help shape what's next. Together, we deliver the full promise of what technology can do.
* Together, we Make Amazing Happen.
* CDW is an equal opportunity employer. All qualified applicants will receive consideration for employment without regards to race, color, religion, sex, sexual orientation, gender identity, national origin, disability status, protected veteran status or any other basis prohibited by state and local law.
Skills Required
- 10+ years of experience in Application Security Engineering
- Hands-on experience embedding security into software design, development, and delivery practices
- Expertise in secure application architecture and design
- Expertise in secure coding practices, code-level vulnerability analysis, and threat modeling
- Background in software engineering, application development, or architecture
- Knowledge of authentication, authorization, session management, API security, secrets management, OWASP Top 10 vulnerabilities, injection, deserialization, SSRF, insecure design, access control, and dependency risk
- Hands-on experience securing applications using modern technology stacks such as C#, Java, Python, JavaScript, TypeScript, or Go
- Experience integrating security into CI/CD pipelines, developer workflows, and engineering platforms
- Experience with SAST, SCA, DAST, IaC scanning, container security, API security testing, and software supply chain security controls
- Ability to investigate complex technical problems, identify root causes, and drive remediation
- Strong written and verbal communication skills
- Ability to influence engineers, platform teams, and senior stakeholders
- Strong ownership and accountability
- Ability to balance hands-on technical execution with mentoring and organization-wide improvements
- Experience defining standards, playbooks, secure reference architectures, or scalable engineering practices
- Experience with software supply chain security, dependency risk management, build pipeline hardening, SBOM, artifact integrity, provenance, and package governance
- Hands-on experience with AI security, including securing AI-enabled applications or LLM-based capabilities
- Familiarity with Zero Trust, secure platform engineering, and policy-as-code
- Experience as an Application Security Champion, Security Champion, embedded security lead, principal engineer, or senior engineer driving application security
- Experience with runtime application protection, exploit prevention, threat detection, and abuse case analysis
- Experience influencing secure development practices across decentralized or federated engineering organizations
- Experience defining and using application security metrics, maturity measures, or risk-based reporting
- Experience designing security controls for cloud-native and distributed systems in Azure, AWS, or GCP
- Experience designing, deploying, or tuning Akamai protections
- Experience reviewing and securing Infrastructure as Code, including Terraform or similar tools
What the Team is Saying
Phil
Practice Vice President
Mason
Sales Intern
Kevin Denison
Director, Strategic Initiatives — U.S. Commercial
Christine A. Leahy
Chair and Chief Executive Officer
CDW Compensation & Benefits Highlights
-
Healthcare Strength — Health coverage is described as comprehensive, with Blue Cross Blue Shield medical options alongside dental, vision, life and disability insurance, plus FSAs/HSAs and mental health/EAP resources. Feedback suggests these core plans form a solid backbone of the package.
-
Parental & Family Support — Family-focused programs include expanded paid parental leave for primary caregivers, adoption assistance, fertility support, childcare and eldercare resources, and onsite Mother’s Rooms. These offerings are prominently featured along with flexibility and work‑life supports.
-
Inclusive Benefits Coverage — Coverage specifically calls out transgender healthcare and dependent care options in addition to mental health resources. This breadth indicates attention to inclusive benefits that address varied employee needs.
CDW Insights
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
CDW Corporation is a leading multi-brand provider of information technology solutions to business, government, education and healthcare customers in the United States, the United Kingdom and Canada. A Fortune 500 company and member of the S&P 500 Index, CDW helps its customers to navigate an increasingly complex IT market and maximize return on their technology investments. For more information about CDW, please visit www.CDW.com. Our broad array of products and services range from hardware and software to integrated IT solutions such as security, cloud, hybrid infrastructure and digital experience.
Why Work With Us
Trust, connection and commitment are at the heart of how we work together to deliver for our customers. It’s why we’re coworkers, not just employees. Coworkers who genuinely believe in supporting our customers and one another. We collectively forge our path forward with a level of commitment that speaks to who we are and where we’re headed.
Gallery
CDW Offices
Hybrid Workspace
Employees engage in a combination of remote and on-site work.
CDW is committed to offering a high quality, flexible work experience centered around connection, collaboration, and coworker well-being. Our flexible hybrid approach enables coworkers to get the best of working from home and being together.
Typical time on-site:
Not Specified
