Staff Engineer, Application Security
ACV Auctions2 months ago
Buffalo, NY, USAStaff+
Responsibilities
- Design, implement, and scale ACV’s Application Security Program using Secure SDLC and shift-left practices.
- Serve as the subject matter expert for secure application architecture, code analysis, and application threat modeling.
- Integrate security tools and controls such as SAST, DAST, SCA, and secrets management into CI/CD pipelines.
- Conduct or oversee escalated code reviews, security assessments, and penetration testing for internal and external applications.
- Lead threat-modeling workshops, developer security training, and awareness initiatives.
- Develop security policies, standards, and automation to support a secure-by-default engineering culture.
- Work hands-on with developers to remediate critical vulnerabilities.
- Collaborate with compliance and risk teams on security audits and regulatory requirements.
- Stay current on emerging threats, vulnerabilities, and secure development practices.
Requirements
- Demonstrated experience building or leading a successful Application Security Program at a technology-driven organization.
- Deep knowledge of web and mobile vulnerabilities, including the OWASP Top 10, microservices security, and cloud-native architectures, preferably AWS.
- Strong proficiency with security testing tools such as Burp Suite, GitHub Advanced Security, Snyk, and Checkmarx.
- Familiarity with modern development stacks and languages including Node.js, Python, Go, and React.
- Hands-on experience securing CI/CD environments and partnering with DevOps teams.
- Experience conducting code and security reviews of architecture designs, APIs, and infrastructure-as-code.
- Strong written and verbal English communication, organizational, critical-thinking, problem-solving, and influencing skills.
- Industry certifications such as OSWE, GWAPT, CSSLP, or CISSP are a plus.
Benefits
- Multiple medical plans, including a high-deductible low-cost health plan.
- Company-sponsored short-term disability, long-term disability, and life insurance.
- Optional dental, vision, supplemental life/AD&D, legal/ID protection, accident, and critical illness insurance.
- Paid time off including uncapped vacation, paid sick leave, company holidays, floating holidays, parental leave, bereavement leave, jury duty leave, voting leave, and other legally required leave.
- Employee Stock Purchase Program and additional opportunities to earn company stock.
- Company 401(k) retirement plan.
About ACV Auctions
ACV Auctions operates a dealer-only online wholesale marketplace for used vehicles, alongside data, inspection, transportation, and floorplan financing services for auto retailers and commercial sellers. It earns fees from transactions and ancillary products delivered through brands such as ACV Transportation, ACV Capital, True360, and MAX Digital. Founded in 2014 and headquartered in Buffalo, New York, ACV is a public company traded on the NASDAQ.