Remote Senior Application Security Engineer

Liquidity Services Inc.; United States; Remote; USD 107,000 - 134,000; Full time

Benefits offered by this job

Competitive wages

401(k) plan

Paid time off (PTO) and holidays

Paid parental leave

Life and disability insurance

Employee Assistance Program (EAP)

Professional development and tuition

Job summary

Liquidity Services Inc. is seeking an Application Security Engineer to establish and enforce security standards across the organization, perform assessments, and remediate vulnerabilities in collaboration with internal and external teams.

The role covers security testing, threat modeling, secure coding guidance, tool automation, and governance across SCA, SBOM, and secure software supply chain practices, including AI security considerations.

Qualifications

• Minimum 5+ years of experience in application security, secure software development, penetration testing, or DevSecOps security.
• Experience influencing engineering teams and driving remediation across multiple development teams.
• Deep knowledge of AWS, Azure, or GCP, including how to secure their services.
• Knowledge of threat modeling, secure code reviews, and the Secure Software Development Life Cycle (SSDLC).
• Knowledge of version control (Git), containerization (Docker), and automated testing integration.
• Knowledge of pipeline permissions, secrets in builds, branch protection, deployment approvals, artifact integrity, and code signing.
• Experience using AI-assisted development tools to improve productivity while maintaining code quality and security.
• Ability to critically review, validate, and test AI-generated code rather than accepting generated outputs without verification.
• Understanding of the security, privacy, and intellectual property considerations associated with AI-assisted software development.
• Practical understanding of container security where Docker or Kubernetes are used, including securing container images through approved base images and vulnerability scanning in CI/CD.
• Knowledge of securing REST and GraphQL APIs against OWASP API Security Top 10 risks, including broken authentication, excessive data exposure, lack of rate limiting, and injection attacks.
• Experience implementing API gateways, OAuth 2.0, and API key rotation policies.
• Experience reviewing and securing Infrastructure as Code used to deploy and manage cloud services across AWS and Azure environments, including Terraform, CloudFormation, ARM/Bicep, or similar templates.
• Practical experience preventing hardcoded credentials in source code and pipelines.
• Knowledge of secrets managers, including AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, and Google Secret Manager, and automated secrets scanning in pre‑commit hooks and CI/CD.

Responsibilities

• Security Testing: Perform penetration testing, vulnerability scanning, and manual and automated secure code reviews, including reviews of AI-generated code where applicable.
• Threat Modeling: Analyze system designs to identify potential attack vectors and risks before deployment.
• Developer Collaboration: Bridge the gap between security and engineering teams by advising on secure coding standards such as the OWASP Top 10.
• Tool Automation: Configure and manage Web Application Firewalls (WAFs), CI/CD security pipelines, and automated scanning tools.
• Identity and Access Security: Manage security considerations related to SSO, SAML/OIDC, OAuth, MFA, service accounts, privileged access, and least-privilege principles.
• Secure SDLC Governance: Define secure design reviews, security gates, release approvals, exception-handling processes, and remediation tracking.
• Software Supply Chain Security: Oversee Software Composition Analysis (SCA), SBOM generation and review, open-source dependency risk management, package repository security, artifact signing and verification, and third-party component security reviews.
• Security Architecture Reviews: Review application and cloud architectures during the design phase, identify security risks before implementation, and define compensating controls and secure design patterns.
• AI and Emerging Technology Security: Promote the secure use of AI coding assistants, review AI-generated code, protect sensitive information in AI workflows, and assess AI-related security risks.
• Vulnerability Management: Manage vulnerability triage, risk ratings, remediation deadlines, false-positive handling, retesting, and reporting.
• Data Protection and Privacy by Design: Support the secure handling of PII, encryption, retention, data minimization, privacy impact awareness, and regulatory expectations.
• Payment Security: Secure payment integrations, assess PCI DSS scope, and review vendor AOCs and payment-provider security responsibilities.
• Incident Response: Support application security logging, alerting, forensic readiness, incident response, and post-incident corrective actions.

Tools

GitHub Advanced Security

SonarQube

Job description

Liquidity Services Inc. is seeking an Application Security Engineer to establish and enforce security standards across the organization, perform assessments, and remediate vulnerabilities in collaboration with internal and external teams.

The role covers security testing, threat modeling, secure coding guidance, tool automation, and governance across SCA, SBOM, and secure software supply chain practices, including AI security considerations.