Application Security Engineer III

Description GovDeals; United States; Remote; USD 107,000 - 134,000; Full time

Benefits offered by this job

Competitive wages

401(k) plan

Paid time off (PTO) and holidays

Paid parental leave

Life and disability insurance

Employee Assistance Program (EAP)

Professional development and tuition),

Job summary

Liquidity Services seeks an application security engineer to establish and enforce security standards across the organization, conducting assessments and remediating vulnerabilities in collaboration with internal and external teams.

The role focuses on threat modeling, secure coding guidance, API and cloud security, and secure SDLC governance. It requires evaluating AI-assisted development tools and maintaining strong security practices across AWS/Azure/GCP and CI/CD pipelines.

Qualifications

• Minimum 5+ years in application security, secure software development, pen testing, or DevSecOps security.
• Experience influencing engineering teams and remediation across multiple development teams.
• Deep knowledge of AWS, Azure, or GCP and how to secure their services.
• Knowledge of SSDLC, threat modeling, secure code reviews, and related practices.
• Experience with Git, Docker, and automated testing integrations.
• Experience securing pipelines, secrets, and artifact integrity.

Responsibilities

• Perform security assessments, penetration testing, and secure code reviews.
• Analyze designs for potential attack vectors and risks before deployment.
• Advise on secure coding standards and OWASP Top 10 across teams.
• Configure and manage WAFs, CI/CD security, and automated scanners.
• Manage SSO, SAML/OIDC, OAuth, MFA, and least-privilege access.
• Define secure design reviews, security gates, release approvals, and remediation tracking.
• Oversee software composition analysis, SBOMs, and third‑party component security.
• Review architectures to define compensating controls and secure patterns.
• Promote secure use of AI coding assistants and review AI-generated code.
• Manage vulnerability triage, risk ratings, remediation deadlines, retesting and reporting.
• Support secure handling of PII, encryption, data minimization and privacy by design.
• Secure payment integrations, assess PCI DSS scope, and review vendor security.
• Support incident response, logging, alerting, and post-incident actions.

Skills

Cloud security

Threat modeling

Secure SDLC

Code reviews

AI-assisted tools

Vulnerability management

API security

CI/CD security

Education

5+ years in application security

SSDLC knowledge

Bachelors in CS or related

Tools

Docker

Git

Terraform

CloudFormation

SCA/DAST/SAST tools

OWASP ZAP

Secrets management

Job description

The application security engineer will be responsible for establishing and enforcing security standards and best practices within the organization. They will conduct regular security assessments, identify vulnerabilities, and work with internal and external teams to remediate them. They also keep up to date with the latest security threats, trends, and countermeasures to ensure that the organization's applications are always protected.

Responsibilities

• Security Testing: Perform penetration testing, vulnerability scanning, and manual and automated secure code reviews, including reviews of AI-generated code where applicable.
• Threat Modeling: Analyze system designs to identify potential attack vectors and risks before deployment.
• Developer Collaboration: Bridge the gap between security and engineering teams by advising on secure coding standards, such as the OWASP Top 10.
• Tool Automation: Configure and manage Web Application Firewalls (WAFs), CI/CD security pipelines, and automated scanning tools.
• Identity and Access Security: Manage security considerations related to SSO, SAML/OIDC, OAuth, MFA, service accounts, privileged access, and least-privilege principles.
• Secure SDLC Governance: Define secure design reviews, security gates, release approvals, exception-handling processes, and remediation tracking.
• Software Supply Chain Security: Oversee Software Composition Analysis (SCA), SBOM generation and review, open-source dependency risk management, package repository security, artifact signing and verification, and third-party component security reviews.
• Security Architecture Reviews: Review application and cloud architectures during the design phase, identify security risks before implementation, and define compensating controls and secure design patterns.
• AI and Emerging Technology Security: Promote the secure use of AI coding assistants, review AI-generated code, protect sensitive information in AI workflows, and assess AI-related security risks.
• Vulnerability Management: Manage vulnerability triage, risk ratings, remediation deadlines, false-positive handling, retesting, and reporting.
• Data Protection and Privacy by Design: Support the secure handling of PII, encryption, retention, data minimization, privacy impact awareness, and regulatory expectations.
• Payment Security: Secure payment integrations, assess PCI DSS scope, and review vendor AOCs and payment-provider security responsibilities.
• Incident Response: Support application security logging, alerting, forensic readiness, incident response, and post-incident corrective actions.

Qualifications

Education/ Experience:

• Minimum 5+ years of experience in application security, secure software development, penetration testing, or DevSecOps security.
• Experience influencing engineering teams and driving remediation efforts across multiple development teams.
• Deep knowledge of AWS, Azure, or GCP, including how to secure their services.
• Knowledge of threat modeling, secure code reviews, and the Secure Software Development Life Cycle (SSDLC).
• Knowledge of version control (Git), containerization (Docker), and automated testing integration.
• Knowledge of pipeline permissions, secrets in builds, branch protection, deployment approvals, artifact integrity, and code signing.
• Experience using AI-assisted development tools (e.g., Claude, GitHub Copilot, ChatGPT, Cursor, Amazon Q, or similar) to improve productivity while maintaining code quality and security.
• Ability to critically review, validate, and test AI-generated code rather than accepting generated outputs without verification.
• Understanding of the security, privacy, and intellectual property considerations associated with AI-assisted software development.
• Practical understanding of container security where Docker or Kubernetes are used, including securing container images through approved base images and vulnerability scanning in CI/CD.
• Knowledge of securing REST and GraphQL APIs against OWASP API Security Top 10 risks, including broken authentication, excessive data exposure, lack of rate limiting, and injection attacks.
• Experience implementing API gateways, OAuth 2.0, and API key rotation policies.
• Experience reviewing and securing Infrastructure as Code used to deploy and manage cloud services across AWS and Azure environments, including Terraform, CloudFormation, ARM/Bicep, or similar templates.
• Practical experience preventing hardcoded credentials in source code and pipelines.
• Knowledge of secrets managers, including AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, and Google Secret Manager, and automated secrets scanning in pre-commit hooks and CI/CD.

Strong ability to read, review, and write code in the languages used across the environment, including:

• C#/.NET for Microsoft-based services and integrations
• Java for enterprise or legacy applications
• AJAX, Angular, and REACT for Front-End Web Development Technologies
• Python and PowerShell for automation, scripting, security tooling, and operational workflows

SQL for secure database interaction and query review
Experience with code security and dependency management tools such as:

• GitHub Advanced Security
• SonarQube
• Similar SAST, DAST, SCA, and secret-scanning tools

Desired Certifications:

• CISSP: Certified Information Systems Security Professional
• CSSLP: Certified Secure Software Lifecycle Professional
• CASE: Certified Application Security Engineer
• OSCP / OSWE: Offensive Security credentials
  Skills and Ability:
• Strong communication to influence developers and stakeholders on remediation priorities.
• Ability to clearly explain security flaws and fixes to software developers.
• Strong teamwork skills to integrate security into fast-paced agile development cycles.
• Critical thinking to analyze complex codebases and anticipate how attackers might expose.
  

Work Conditions/ Physical Demands:

• This position is primarily performed in a home office or other approved remote work environment. The employee is expected to maintain a safe, secure, and distraction-free workspace with reliable internet access. Duties primarily involve prolonged periods of sitting, working on a computer, and communicating via phone and video conferencing.
• The employee must be able to frequently use a computer, keyboard, mouse, and other standard office equipment, as well as communicate effectively with colleagues, customers, and business partners. Occasional lifting of office materials or equipment up to 15 pounds may be required.

Travel:

• Occasional travel may be required for meetings, training, or business needs (up to 10%).

Compensation is determined by various factors such as location, education, knowledge, skills, competencies, and experience, as well as internal and external equity and organizational needs. Additionally, this role is eligible for an annual discretionary bonus.

The salary range for this position is $106,800 to $133,500 annually. The posted range reflects our national average range for the job. We may ultimately pay more or less than the published range based on the factors mentioned above. This range may be modified in the future.

At Liquidity Services, we provide a comprehensive benefits package that supports our employees' well-being and provides growth opportunities and career development. Our offerings include:

• Competitive wages
• 401(k) plan
• Paid time off (PTO) and holidays
• Paid parental leave
• Life and disability insurance
• Employee Assistance Program (EAP)
• Professional development and tuition assistance

Disclaimer: The above statements are intended to describe the general nature and level of work being performed. They are not intended to be construed as an exhaustive list of all responsibilities, duties and skills required of personnel so classified. Liquidity Services Inc. reserves the right to modify position duties at any time due to business necessity.

Liquidity Services is an Equal Opportunity Employer.

About Us

Liquidity Services (NASDAQ: LQDT) operates the world’s largest B2B e-commerce marketplace platform for surplus assets, with over $15 billion in completed transactions to more than 6 million qualified buyers worldwide and 15,000 corporate and government sellers. It supports its clients’ sustainability efforts by helping them extend the life of assets, prevent unnecessary waste and carbon emissions, and reduce the number of products headed to landfills.

Job Info

• Job Identification 405
• Job Category IT - Infrastructure & Operations