Application Security Engineer III

Liquidity Services Inc. • United States,

21h • $106,800 - $133,500 • Remote

About The Position

The Application Security Engineer is responsible for establishing and enforcing organizational security standards and best practices. The role conducts security assessments, identifies vulnerabilities, and works with internal and external teams to remediate them, while staying current with security threats, trends, and countermeasures to protect the organization’s applications.

The engineer integrates security throughout the software development lifecycle, including threat modeling, architecture reviews, secure code reviews, vulnerability management, and governance of security gates and release approvals. The position supports application and cloud security, identity and access controls, software supply chain security, AI-assisted development security, data protection and privacy, payment security, and application incident response. It collaborates with developers and stakeholders to explain security issues, prioritize remediation, and embed secure practices in agile development.

The position is primarily performed from a home office or another approved remote work environment. Occasional travel of up to 10% may be required. Work involves prolonged computer use and communication by phone and video conferencing; occasional lifting of office materials or equipment up to 15 pounds may be required.

Requirements

• At least 5 years of experience in application security, secure software development, penetration testing, or DevSecOps security.
• Experience influencing engineering teams and driving remediation across multiple development teams.
• Deep knowledge of AWS, Azure, or GCP, including securing cloud services.
• Solid understanding of DNS, HTTP, cookies, sessions, TLS, and browser security controls.
• Knowledge of threat modeling, secure code reviews, and the Secure Software Development Life Cycle (SSDLC).
• Knowledge of Git, Docker, and automated testing integration.
• Knowledge of pipeline permissions, secrets in builds, branch protection, deployment approvals, artifact integrity, and code signing.
• Experience using AI-assisted development tools such as Claude, GitHub Copilot, ChatGPT, Cursor, Amazon Q, or similar, while maintaining code quality and security.
• Ability to critically review, validate, and test AI-generated code rather than accepting generated output without verification.
• Understanding of security, privacy, and intellectual property considerations associated with AI-assisted software development.
• Practical understanding of container security where Docker or Kubernetes are used, including approved base images and vulnerability scanning in CI/CD.
• Knowledge of securing REST and GraphQL APIs against OWASP API Security Top 10 risks, including broken authentication, excessive data exposure, lack of rate limiting, and injection attacks.
• Experience implementing API gateways, OAuth 2.0, and API key rotation policies.
• Experience reviewing and securing Infrastructure as Code used to deploy and manage cloud services across AWS and Azure, including Terraform, CloudFormation, ARM/Bicep, or similar templates.
• Practical experience preventing hardcoded credentials in source code and pipelines.
• Knowledge of secrets managers, including AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, and Google Secret Manager, and automated secrets scanning in pre-commit hooks and CI/CD.
• Strong ability to read, review, and write code in JavaScript/TypeScript, C#/.NET, Java, AJAX, Angular, React, Python, PowerShell, and SQL.
• Experience with code security and dependency management tools such as Claude Security, Copilot Security, GitHub Dependabot, GitHub Advanced Security, SonarQube, OWASP Dependency-Check, or similar SAST, DAST, SCA, and secret-scanning tools.
• Strong communication skills to influence developers and stakeholders on remediation priorities.
• Ability to clearly explain security flaws and fixes to software developers.
• Strong teamwork skills to integrate security into fast-paced agile development cycles.
• Critical thinking to analyze complex codebases and anticipate how attackers might exploit them.
• Ability to maintain a safe, secure, and distraction-free remote workspace with reliable internet access.
• Ability to frequently use a computer, keyboard, mouse, and standard office equipment; communicate effectively; and occasionally lift office materials or equipment up to 15 pounds.

Nice To Haves

• CISSP: Certified Information Systems Security Professional.
• CSSLP: Certified Secure Software Lifecycle Professional.
• CASE: Certified Application Security Engineer.
• OSCP or OSWE offensive security credentials.

Responsibilities

• Perform penetration testing, vulnerability scanning, and manual and automated secure code reviews, including reviews of AI-generated code where applicable.
• Analyze system designs to identify potential attack vectors and risks before deployment.
• Advise engineering teams on secure coding standards, including the OWASP Top 10.
• Configure and manage Web Application Firewalls, CI/CD security pipelines, and automated scanning tools.
• Manage security considerations involving SSO, SAML/OIDC, OAuth, MFA, service accounts, privileged access, and least-privilege principles.
• Define secure design reviews, security gates, release approvals, exception-handling processes, and remediation tracking.
• Oversee Software Composition Analysis, SBOM generation and review, open-source dependency risk management, package repository security, artifact signing and verification, and third-party component security reviews.
• Review application and cloud architectures during design, identify security risks before implementation, and define compensating controls and secure design patterns.
• Promote secure use of AI coding assistants, review AI-generated code, protect sensitive information in AI workflows, and assess AI-related security risks.
• Manage vulnerability triage, risk ratings, remediation deadlines, false-positive handling, retesting, and reporting.
• Support secure handling of PII, encryption, retention, data minimization, privacy impact awareness, and regulatory expectations.
• Secure payment integrations, assess PCI DSS scope, and review vendor AOCs and payment-provider security responsibilities.
• Support application security logging, alerting, forensic readiness, incident response, and post-incident corrective actions.
• Influence developers and stakeholders on remediation priorities and explain security flaws and fixes to software developers.
• Integrate security into fast-paced agile development cycles.

Benefits

• Competitive wages.
• Healthcare coverage, including medical, dental, vision, prescription drugs, and FSAs.
• 401(k) plan.
• Paid time off and holidays.
• Paid parental leave.
• Life and disability insurance.
• Employee Assistance Program (EAP).
• Professional development and tuition assistance.
• Annual discretionary bonus eligibility.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed