Application Security Engineer III

Liquidity Services • Bethesda, AL

20h • Remote

About The Position

The Application Security Engineer is responsible for establishing and enforcing organizational security standards and best practices. The role conducts security assessments, identifies application vulnerabilities, and collaborates with internal and external teams to remediate them. The engineer stays current with security threats, trends, and countermeasures to help protect the organization’s applications.

The position incorporates security throughout the software development lifecycle, including threat modeling, secure design and architecture reviews, code and dependency reviews, security automation, vulnerability management, identity and access security, software supply chain security, privacy by design, payment security, and incident response. It also promotes secure use of AI-assisted development tools and evaluates risks associated with AI-generated code and workflows.

The role is primarily performed from a home office or other approved remote work environment. Occasional travel of up to 10% may be required. The position offers an annual discretionary bonus and a comprehensive benefits package. The salary range is $106,800 to $133,500 annually; compensation may vary based on location, education, skills, experience, and other stated factors.

Requirements

• At least 5 years of experience in application security, secure software development, penetration testing, or DevSecOps security.
• Experience influencing engineering teams and driving remediation across multiple development teams.
• Deep knowledge of AWS, Azure, or GCP, including how to secure their services.
• Solid understanding of DNS, HTTP, cookies, sessions, TLS, and browser security controls.
• Knowledge of threat modeling, secure code reviews, and the Secure Software Development Life Cycle (SSDLC).
• Knowledge of Git, Docker, and automated testing integration.
• Knowledge of pipeline permissions, secrets in builds, branch protection, deployment approvals, artifact integrity, and code signing.
• Experience using AI-assisted development tools and critically reviewing, validating, and testing AI-generated code.
• Understanding of security, privacy, and intellectual property considerations associated with AI-assisted software development.
• Practical understanding of container security, including approved base images and vulnerability scanning in CI/CD where Docker or Kubernetes are used.
• Knowledge of securing REST and GraphQL APIs against OWASP API Security Top 10 risks.
• Experience implementing API gateways, OAuth 2.0, and API key rotation policies.
• Experience reviewing and securing Infrastructure as Code across AWS and Azure environments, using tools such as Terraform, CloudFormation, ARM/Bicep, or similar templates.
• Practical experience preventing hardcoded credentials in source code and pipelines.
• Knowledge of secrets managers such as AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, and Google Secret Manager, and automated secrets scanning in pre-commit hooks and CI/CD.
• Ability to read, review, and write code in JavaScript/TypeScript, C#/.NET, Java, Python, PowerShell, and SQL; familiarity with AJAX, Angular, and React front-end technologies.
• Experience with code security and dependency management tools such as Claude Security, Copilot Security, GitHub Dependabot, GitHub Advanced Security, SonarQube, OWASP Dependency-Check, or similar SAST, DAST, SCA, and secret-scanning tools.
• Strong communication skills to influence developers and stakeholders on remediation priorities and clearly explain security flaws and fixes.
• Strong teamwork skills to integrate security into fast-paced agile development cycles.
• Critical thinking skills to analyze complex codebases and anticipate how attackers might exploit them.
• Maintain a safe, secure, and distraction-free remote workspace with reliable internet access.
• Ability to perform prolonged periods of sitting, use a computer and standard office equipment frequently, and communicate effectively via phone and video conferencing.
• Ability to occasionally lift office materials or equipment up to 15 pounds.

Nice To Haves

• CISSP (Certified Information Systems Security Professional).
• CSSLP (Certified Secure Software Lifecycle Professional).
• CASE (Certified Application Security Engineer).
• OSCP or OSWE offensive security credentials.

Responsibilities

• Perform penetration testing, vulnerability scanning, and manual and automated secure code reviews, including reviews of AI-generated code where applicable.
• Analyze system designs to identify potential attack vectors and risks before deployment.
• Advise engineering teams on secure coding standards, including the OWASP Top 10.
• Configure and manage Web Application Firewalls, CI/CD security pipelines, and automated scanning tools.
• Manage security considerations related to SSO, SAML/OIDC, OAuth, MFA, service accounts, privileged access, and least-privilege principles.
• Define secure design reviews, security gates, release approvals, exception-handling processes, and remediation tracking.
• Oversee Software Composition Analysis, SBOM generation and review, open-source dependency risk management, package repository security, artifact signing and verification, and third-party component security reviews.
• Review application and cloud architectures during design, identify security risks before implementation, and define compensating controls and secure design patterns.
• Promote secure use of AI coding assistants, review AI-generated code, protect sensitive information in AI workflows, and assess AI-related security risks.
• Manage vulnerability triage, risk ratings, remediation deadlines, false-positive handling, retesting, and reporting.
• Support secure handling of PII, encryption, retention, data minimization, privacy impact awareness, and regulatory expectations.
• Secure payment integrations, assess PCI DSS scope, and review vendor AOCs and payment-provider security responsibilities.
• Support application security logging, alerting, forensic readiness, incident response, and post-incident corrective actions.
• Influence engineering teams and drive remediation efforts across multiple development teams.
• Review and secure Infrastructure as Code used to deploy and manage cloud services.
• Prevent hardcoded credentials in source code and pipelines and use secrets-management and automated scanning practices.
• Explain security flaws and fixes to software developers and integrate security into agile development cycles.

Benefits

• Annual discretionary bonus.
• Healthcare coverage, including medical, dental, vision, prescription drugs, and FSAs.
• 401(k) plan.
• Paid time off (PTO) and holidays.
• Paid parental leave.
• Life and disability insurance.
• Employee Assistance Program (EAP).
• Professional development and tuition assistance.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed