Staff Engineer, Application Security
ACV Auctions9 days ago
Buffalo, NY, USAStaff+
Responsibilities
- Design, implement, and scale ACV’s Application Security Program using Secure SDLC and shift-left practices.
- Serve as the subject matter expert for secure application architecture, code analysis, and application threat modeling.
- Integrate security tools and controls such as SAST, DAST, SCA, and secrets management into CI/CD pipelines.
- Conduct or oversee escalated code reviews, security assessments, and penetration testing for internal and external applications.
- Lead threat-modeling workshops, developer security training, and awareness initiatives.
- Develop security policies, standards, and automation to support a secure-by-default engineering culture.
- Work hands-on with developers to remediate critical vulnerabilities.
- Collaborate with compliance and risk teams on security audits and regulatory requirements.
- Stay current on emerging threats, vulnerabilities, and secure development practices.
Requirements
- Demonstrated experience building or leading a successful Application Security Program at a technology-driven organization.
- Deep knowledge of web and mobile vulnerabilities, including the OWASP Top 10, microservices security, and cloud-native architectures, preferably AWS.
- Strong proficiency with security testing tools such as Burp Suite, GitHub Advanced Security, Snyk, and Checkmarx.
- Familiarity with modern development stacks and languages including Node.js, Python, Go, and React.
- Hands-on experience securing CI/CD environments and partnering with DevOps teams.
- Experience conducting code and security reviews of architecture designs, APIs, and infrastructure-as-code.
- Strong written and verbal English communication, organizational, critical-thinking, problem-solving, and influencing skills.
- Industry certifications such as OSWE, GWAPT, CSSLP, or CISSP are a plus.
Benefits
- Multiple medical plans, including a high-deductible low-cost health plan.
- Company-sponsored short-term disability, long-term disability, and life insurance.
- Optional dental, vision, supplemental life/AD&D, legal/ID protection, accident, and critical illness insurance.
- Paid time off including uncapped vacation, paid sick leave, company holidays, floating holidays, parental leave, bereavement leave, jury duty leave, voting leave, and other legally required leave.
- Employee Stock Purchase Program and additional opportunities to earn company stock.
- Company 401(k) retirement plan.