Staff Engineer, Application Security
About The Position
ACV is a technology company that has revolutionized how dealers buy and sell cars online. We are transforming the automotive industry. ACV Auctions Inc. (ACV), has applied innovation and user-designed, data driven applications and solutions. We are building the most trusted and efficient digital marketplace with data solutions for sourcing, selling and managing used vehicles with transparency and comprehensive insights that were once unimaginable. We are disruptors of the industry and we want you to join us on our journey. At ACV we focus on the Health, Physical, Financial, Social and Emotional Wellness of our Teammates and, to support this, we offer: Multiple medical plans including a high deductible, low cost health plan Company-sponsored (paid) Short-Term Disability, Long-Term Disability, and Life Insurance Comprehensive optional benefits such as Dental, Vision, Supplemental Life/AD&D, Legal/ID Protection, and Accident and Critical Illness Insurance Generous paid time off options, including uncapped vacation days, the greater of 3 paid sick days or in accordance with the applicable state or local paid sick leave law, 6 paid company holidays, 2 floating holidays, parental leave, bereavement leave, jury duty leave, voting leave, and other forms of paid leave as required by applicable law or regulation Employee Stock Purchase Program with additional opportunities to earn stock in the Company Retirement planning through the Company’s 401(k)
Requirements
- Ability to read, write, speak and understand English.
- Attention to detail and strong organizational skills
- Critical thinking and problem-solving abilities
- Effective written and verbal English communication skills
- Demonstrated experience building or leading a successful Application Security Program at a technology-driven organization
- Deep technical knowledge of common web and mobile vulnerabilities (e.g., OWASP Top 10), microservices security, and cloud-native architectures (preferably AWS)
- Strong proficiency with security testing tools (e.g., Burp Suite, GitHub Advanced Security, Snyk, Checkmarx, etc.)
- Familiarity with modern development stacks and languages (e.g., Node.js, Python, Go, React).
- Hands-on experience securing CI/CD environments and working with DevOps teams
- Experience conducting code and security reviews of architecture designs, APIs, and infrastructure-as-code
- Strong communication skills with the ability to influence engineers and leadership alike as well as understand that different audiences require different messages
Nice To Haves
- Industry certifications a plus (e.g., OSWE, GWAPT, CSSLP, CISSP)
Responsibilities
- Actively and consistently support all efforts to simplify and enhance the customer experience.
- Design, implement, and scale ACV's Application Security Program, aligning with Secure SDLC best practices and taking a Shift Left by default approach.
- Serve as the subject matter expert for secure application architecture, code analysis, and application threat modeling.
- Partner with engineering and security teams to integrate security tools and controls into CI/CD pipelines (e.g., SAST, DAST, SCA, secrets management).
- Conduct and oversee escalated code reviews, security assessments, and pen testing of internal and external applications.
- Lead threat modeling workshops, security training, and awareness initiatives for developers and architects.
- Develop policies, standards, and automation to support a secure-by-default engineering culture.
- Drive remediation efforts by working hands-on with developers to fix critical vulnerabilities.
- Collaborate with compliance and risk teams to meet security audit and regulatory requirements (SOC 2, ISO 27001, etc.).
- Stay current on emerging threats, vulnerabilities, and secure development trends.
- Perform additional duties as assigned.
Benefits
- Multiple medical plans including a high deductible, low cost health plan
- Company-sponsored (paid) Short-Term Disability, Long-Term Disability, and Life Insurance
- Comprehensive optional benefits such as Dental, Vision, Supplemental Life/AD&D, Legal/ID Protection, and Accident and Critical Illness Insurance
- Generous paid time off options, including uncapped vacation days, the greater of 3 paid sick days or in accordance with the applicable state or local paid sick leave law, 6 paid company holidays, 2 floating holidays, parental leave, bereavement leave, jury duty leave, voting leave, and other forms of paid leave as required by applicable law or regulation
- Employee Stock Purchase Program with additional opportunities to earn stock in the Company
- Retirement planning through the Company’s 401(k)
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
