Senior AppSec Engineer: Drive Secure CI/CD at Scale

11105 Expedia, Inc.; Seattle (WA); On-site; USD 146,000 - 205,000; Full time

Benefits offered by this job

Medical, dental, and vision coverage

Paid time off

Wellness and travel reimbursement

Travel discounts

IATAN membership

Job summary

Expedia Group is seeking an Application Security Engineer III in Seattle to drive secure software delivery across the development lifecycle. You will embed security requirements, integrate tooling, and collaborate with product, engineering, privacy, and compliance teams to mitigate risks at scale.

The role emphasizes threat modeling, secure design reviews, and practical use of SAST/DAST/SCA tools, with experience in CI/CD environments and modern languages like Java or Python.

Qualifications

• Bachelor's degree in Computer Science or related field or equivalent professional experience.
• 5+ years of relevant professional experience.
• Experience in application security, product security, DevSecOps, or security engineering supporting modern CI/CD pipelines, cloud-native services, and secure software delivery practices across multiple services or domains.
• Practical experience with software supply chain security, including SBOMs, signing or attestation, secure build pipelines, and SAST, DAST, and SCA tools.
• Experience operating and tuning vulnerability management and security tooling platforms and integrating them with CI/CD pipelines (e.g., GitHub Actions, Jenkins, Spinnaker) and developer workflows, using Java or Python.

Responsibilities

• Drive shift-left security by embedding security requirements across the software development lifecycle, from design through deployment.
• Integrate, maintain, and continuously improve security tooling and automation across CI/CD pipelines (SAST, DAST, SCA, dependencies).
• Configure, tune, and triage security tools and vulnerability management platforms to reduce false positives and strengthen remediation workflows.
• Partner with product, engineering, platform, privacy, compliance, infrastructure, and security stakeholders to identify, assess, and remediate application security risks.
• Conduct threat modeling, security code reviews, and system design reviews for new and existing features and services.
• Safely integrate and operate AI/ML-enabled security solutions and apply AI/ML concepts to real-world products.

Skills

Application security

DevSecOps

Security tooling

CI/CD pipelines

Java

Python

Education

Bachelor's degree in Computer Science or related field

Tools

Qualys

SCA

Wiz

GHAS

Ox security

GitHub Actions

Jenkins

Spinnaker

Job description

Expedia Group is seeking an Application Security Engineer III in Seattle to drive secure software delivery across the development lifecycle. You will embed security requirements, integrate tooling, and collaborate with product, engineering, privacy, and compliance teams to mitigate risks at scale.

The role emphasizes threat modeling, secure design reviews, and practical use of SAST/DAST/SCA tools, with experience in CI/CD environments and modern languages like Java or Python.