Senior Product Security Engineer — AI-Driven, Secure DevOps

Expedia Group

Seattle (WA)

On-site

USD 146,000 - 205,000

Full time

14 days+

Application generator

Turn this role into an interview — a resume and cover letter built around what this employer wants.

Get past ATS filters

Benefits offered by this job

Medical, dental, and vision coverage

Paid time off

Employee Assistance Program

Wellness and travel reimbursement

Travel discounts

IATAN membership

Job summary

Expedia Group in Seattle is seeking a Security Engineer III who will embed security throughout the software development lifecycle, drive shift-left practices, and architect scalable security tooling for modern CI/CD pipelines. You will partner with product, engineering, and privacy teams to assess risks and implement robust defenses across services.

The role requires 5+ years of relevant experience, deep knowledge of application security and software supply chain, and hands-on use of tooling

Qualifications

Bachelor’s degree in Computer Science or a related technical field; or equivalent related professional experience.
5+ years of relevant professional experience.
Experience in application security, product security, DevSecOps, or security engineering supporting modern CI/CD pipelines, cloud-native services, and secure software delivery practices across multiple services or domains.
Practical experience with software supply chain security, including SBOMs, signing or attestation, secure build pipelines, and using SAST, DAST, and SCA to protect against open-source and supply chain risks.
Practical experience operating and tuning vulnerability management and security tooling platforms (e.g., Qualys, SCA, Wiz, GHAS, Ox security, integrating them with CI/CD pipelines (e.g., GitHub Actions, Jenkins, Spinnaker), ticketing systems, and developer workflows, and using modern programming languages such as Java or Python to automate security outcomes.

Responsibilities

Drive shift-left security practices by embedding security requirements and controls throughout the software development lifecycle, from design through deployment.
Integrate, maintain, and continuously improve security tooling and automation across CI/CD pipelines, including capabilities such as SAST, DAST, SCA, dependency scanning, and software supply chain protections.
Configure, tune, and triage security tools and vulnerability management platforms to reduce false positives, improve signal quality, and strengthen remediation workflows for developers.
Partner closely with product, engineering, platform, privacy, compliance, infrastructure, and security stakeholders to identify, assess, and remediate application security risks across the services and components you support.
Conduct threat modeling, security code reviews, and system design reviews, including low-level design, API design, and data modeling, for new and existing features and services.
Safely integrate and operate AI/ML-enabled solutions that improve security outcomes, applying familiarity with AI-driven systems, tools, or workflows and applying AI/ML concepts to real world products.