AppSec Architect & DevSecOps Leader

ACV Auctions; Buffalo, Northern (NY, KY); Hybrid; USD 110,000 - 170,000; Full time

Benefits offered by this job

Health plans

Disability & Life Insurance

Dental & Vision

Paid time off

Stock Purchase Program

401(k)

Job summary

ACV Auctions is seeking an Application Security Engineer to lead the development and maturation of our AppSec program. You will collaborate across engineering, product, and DevOps to ensure secure design, implementation, and deployment of our cloud-native applications and services.

This role targets a security leader with a track record of embedding security into modern SaaS lifecycles, and you will drive security in a fast-paced DevSecOps environment.

Qualifications

• Proven experience building or leading an AppSec program in a tech-driven org.
• Deep knowledge of web/mobile vulnerabilities (OWASP Top 10) and cloud-native security.
• Hands-on with security testing tools and securing CI/CD pipelines.
• Strong communication to influence engineers and leadership.

Responsibilities

• Design, implement, and scale ACV's Application Security Program with Shift Left.
• Act as SME for secure architecture, code analysis, and threat modeling.
• Integrate security tools into CI/CD (SAST, DAST, SCA, secrets).
• Lead security reviews, assessments, and pen testing of apps.
• Run threat modeling workshops and security trainings for developers.
• Develop policies and automation for a secure-by-default culture.
• Drive remediation with developers and coordinate audits (SOC 2, ISO 27001).
• Stay current on threats and secure development trends.

Skills

AppSec program leadership

Secure SDLC & shift-left

Threat modeling

CI/CD security integration

Architecture security guidance

Excellent communication

Cloud-native / AWS

Web and mobile vulnerabilities (OWASP)

Languages: Node.js, Python, Go, React

Code & security reviews of designs/APs

Tools

Burp Suite

GitHub Advanced Security

Snyk

Checkmarx

Job description

ACV Auctions is seeking an Application Security Engineer to lead the development and maturation of our AppSec program. You will collaborate across engineering, product, and DevOps to ensure secure design, implementation, and deployment of our cloud-native applications and services.

This role targets a security leader with a track record of embedding security into modern SaaS lifecycles, and you will drive security in a fast-paced DevSecOps environment.