Staff Engineer, Application Security — Lead Secure DevOps

Socket.dev; Buffalo (NY); On-site; USD 120,000 - 190,000; Full time

Benefits offered by this job

Medical plans

Disability & Life Insurance

PTO & holidays

Stock purchase program

401(k)

Job summary

ACV Auctions Inc. is seeking an Application Security Engineer to lead and mature our AppSec program across SaaS platforms in a fast-paced, cloud-native environment. You will partner with engineering, product and DevOps to embed security into the software development lifecycle and ensure secure design, implementation and deployment.

Ideal candidates have hands-on experience building or leading AppSec programs, strong threat modeling, and proficiency with modern security tools in CI/CD.

Qualifications

• Experience building or leading an AppSec program at a technology-driven organization.
• Deep knowledge of web and mobile vulnerabilities (OWASP Top 10) and cloud-native architectures (AWS).
• Proficiency with security testing tools and secure coding practices.

Responsibilities

• Design, implement, and scale ACV's Application Security Program, aligning with Secure SDLC best practices.
• Partner with engineering and security teams to integrate security tools into CI/CD pipelines (SAST, DAST, SCA, secrets management).
• Conduct and oversee security assessments and pen testing of applications.
• Lead threat modeling workshops and security training for developers and architects.
• Develop policies and automation to support a secure-by-default culture.
• Drive remediation with developers to fix vulnerabilities.

Skills

AppSec leadership

SaaS security

OWASP Top 10

AWS

CI/CD security

Burp Suite

GitHub Advanced Security

Snyk

Checkmarx

Node.js

Python

Tools

Burp Suite

GitHub Advanced Security

Snyk

Checkmarx

Job description

ACV Auctions Inc. is seeking an Application Security Engineer to lead and mature our AppSec program across SaaS platforms in a fast-paced, cloud-native environment. You will partner with engineering, product and DevOps to embed security into the software development lifecycle and ensure secure design, implementation and deployment.

Ideal candidates have hands-on experience building or leading AppSec programs, strong threat modeling, and proficiency with modern security tools in CI/CD.