Application Security Engineer III

11105 Expedia, Inc.; Seattle (WA); On-site; USD 146,000 - 205,000; Full time

Benefits offered by this job

Medical, dental, and vision coverage

Paid time off

Wellness and travel reimbursement

Travel discounts

IATAN membership

Job summary

Expedia Group is seeking an Application Security Engineer III in Seattle to drive secure software delivery across the development lifecycle. You will embed security requirements, integrate tooling, and collaborate with product, engineering, privacy, and compliance teams to mitigate risks at scale.

The role emphasizes threat modeling, secure design reviews, and practical use of SAST/DAST/SCA tools, with experience in CI/CD environments and modern languages like Java or Python.

Qualifications

• Bachelor's degree in Computer Science or related field or equivalent professional experience.
• 5+ years of relevant professional experience.
• Experience in application security, product security, DevSecOps, or security engineering supporting modern CI/CD pipelines, cloud-native services, and secure software delivery practices across multiple services or domains.
• Practical experience with software supply chain security, including SBOMs, signing or attestation, secure build pipelines, and SAST, DAST, and SCA tools.
• Experience operating and tuning vulnerability management and security tooling platforms and integrating them with CI/CD pipelines (e.g., GitHub Actions, Jenkins, Spinnaker) and developer workflows, using Java or Python.

Responsibilities

• Drive shift-left security by embedding security requirements across the software development lifecycle, from design through deployment.
• Integrate, maintain, and continuously improve security tooling and automation across CI/CD pipelines (SAST, DAST, SCA, dependencies).
• Configure, tune, and triage security tools and vulnerability management platforms to reduce false positives and strengthen remediation workflows.
• Partner with product, engineering, platform, privacy, compliance, infrastructure, and security stakeholders to identify, assess, and remediate application security risks.
• Conduct threat modeling, security code reviews, and system design reviews for new and existing features and services.
• Safely integrate and operate AI/ML-enabled security solutions and apply AI/ML concepts to real-world products.

Skills

Application security

DevSecOps

Security tooling

CI/CD pipelines

Java

Python

Education

Bachelor's degree in Computer Science or related field

Tools

Qualys

SCA

Wiz

GHAS

Ox security

GitHub Actions

Jenkins

Spinnaker

Job description

At Expedia Group, we help travelers explore the world, one journey at a time. As a global travel company powered by passionate people, trusted partnerships, and leading technology, we connect travelers, partners, and advertisers through our consumer brands, B2B network, and travel advertising business. Here, you'll do meaningful work that helps millions of people discover, book, and experience travel with more ease, confidence, and joy. Our five Behaviors‑Traveler First, Think Big, Operate with Excellence, Ownership Mindset, and Succeed Together‑help foster a supportive environment where people can grow their careers and have the flexibility, benefits, and support to do their best work. Join us and build for travelers everywhere.

Application Security Engineer III

Our Technology Team partners with teams across Expedia Group to create innovative products, services, and tools to deliver high-quality experiences for travelers, partners, and our employees. A singular technology platform powered by data and machine learning provides secure, differentiated, and personalized experiences that drive loyalty and traveler satisfaction. Our Product Security organization is on a mission to transform how cybersecurity is built and delivered at Expedia Group. We are building the security infrastructure, platforms, and services that empower our engineering teams to ship products faster — with security embedded by default, not bolted on after the fact. We believe that great security accelerates product velocity, and we are looking for a deeply technical, hands‑on individual contributor who will help us architect and realize that vision at scale. If you are passionate about reimagining what a modern product security organization looks like — and have the technical depth to make it real — this role is for you.

• Drive shift‑left security practices by embedding security requirements and controls throughout the software development lifecycle, from design through deployment.
• Integrate, maintain, and continuously improve security tooling and automation across CI/CD pipelines, including capabilities such as SAST, DAST, SCA, dependency scanning, and software supply chain protections.
• Configure, tune, and triage security tools and vulnerability management platforms to reduce false positives, improve signal quality, and strengthen remediation workflows for developers.
• Partner closely with product, engineering, platform, privacy, compliance, infrastructure, and security stakeholders to identify, assess, and remediate application security risks across the services and components you support.
• Conduct threat modeling, security code reviews, and system design reviews, including low‑level design, API design, and data modeling, for new and existing features and services.
• Safely integrate and operate AI/ML-enabled solutions that improve security outcomes, applying familiarity with AI‑driven systems, tools, or workflows and applying AI/ML concepts to real world products.

Minimum Qualifications

• Bachelor’s degree in Computer Science or a related technical field; or equivalent related professional experience.
• 5+ years of relevant professional experience.
• Experience in application security, product security, DevSecOps, or security engineering supporting modern CI/CD pipelines, cloud-native services, and secure software delivery practices across multiple services or domains.
• Practical experience with software supply chain security, including areas such as SBOMs, signing or attestation, secure build pipelines, and using SAST, DAST, and SCA to protect against open-source and supply chain risks.
• Practical experience operating and tuning vulnerability management and security tooling platforms (e.g., Qualys, SCA, Wiz, GHAS, Ox security, integrating them with CI/CD pipelines (e.g., GitHub Actions, Jenkins, Spinnaker), ticketing systems, and developer workflows, and using modern programming languages such as Java or Python to automate security outcomes.

Preferred Qualifications

• Experience applying AI/ML and agentic AI techniques to vulnerability management, including autonomous triage workflows, intelligent prioritization, classification, enrichment, or AI‑assisted security tooling that improves detection, prioritization, and remediation effectiveness.
• Familiarity with AI‑driven systems, tools, or workflows and applying AI/ML concepts to real‑world products, including a working understanding of AI/ML security implications such as the OWASP LLM Top 10 and basic penetration testing concepts.
• Demonstrated success enabling developers on secure development practices and influencing secure engineering decisions within a team, product area, or domain through practical guidance, standards, and playbooks.
• Strong communication skills with the ability to distill complex security topics for broad technical and non-security audiences, operate effectively in fast-paced environments, and navigate ambiguity with sound judgment.
• Proven impact reducing vulnerability backlogs and improving remediation SLAs through automation, tool tuning, stronger signal-to-noise ratios, and data-driven operational improvement.

The total cash range for this position in Seattle is $146,000.00 to $204,500.00.

Employees in this role have the potential to increase their pay up to $233,500.00, which is the top of the range, based on ongoing, demonstrated, and sustained performance in the role. Starting pay for this role will vary based on multiple factors, including location, available budget, and an individual’s knowledge, skills, and experience. Pay ranges may be modified in the future.

Benefits and perks

Expedia Group offers benefits and perks designed to support employees and their families, including medical, dental, and vision coverage, paid time off, an Employee Assistance Program, wellness and travel reimbursement, travel discounts, and International Airlines Travel Agent Network (IATAN) membership.

Accommodation requests

Expedia Group is committed to providing an inclusive and accessible recruiting experience. If you need an accommodation or adjustment due to a disability during the application or recruiting process, please submit a request at https://expedia.service-now.com/askeg?id=job_accommodation.

About Expedia Group

Expedia Group includes three flagship consumer brands - Expedia, Hotels.com, and Vrbo - along with a leading B2B travel business and travel advertising offerings. Across our brands and business, we help travelers explore the world with confidence and ease. Important notice Employment opportunities and job offers at Expedia Group will always come from Expedia Group's Talent Acquisition and hiring teams. Never share sensitive personal information unless you are confident of the recipient. Expedia Group does not extend job offers via email or messaging tools to individuals with whom we have not made prior contact. Our email domain is @expediagroup.com. Equal Opportunity Expedia is committed to creating an inclusive work environment with a diverse workforce. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, veteran status, or any other characteristic protected by law. This employer participates in E-Verify. The employer will provide the Social Security Administration (SSA) and, if necessary, the Department of Homeland Security (DHS) with information from each new employee's I-9 to confirm work authorization. Expedia Group, Inc. (NASDAQ: EXPE) is the global travel marketplace with one purpose: to help travelers explore the world, one journey at a time. Expedia Group™ connects travelers, partners, and advertisers through its trusted brands, leading technology, and rich first‑party data, delivering predictive, personalized experiences that shape the future of travel. Expedia Group’s ecosystem includes three flagship consumer brands – Expedia® Hotels.com®, and Vrbo® – the largest B2B travel business, and a premier advertising network. Guided by an experienced and passionate global team, Expedia Group helps millions of travelers in more than 70 countries explore the world with confidence and ease. Employment opportunities and job offers at Expedia Group will always come from Expedia Group’s Talent Acquisition and hiring teams. Never provide sensitive, personal information to someone unless you’re confident about who they are. We do not send job offers via email, or any other messaging tools, to individuals we have not had prior contact with. Our email domain is @expediagroup.com.