8 days ago
Responsibilities
- Drive shift-left security practices and embed security requirements and controls throughout the software development lifecycle.
- Integrate, maintain, and improve security tooling and automation across CI/CD pipelines, including SAST, DAST, SCA, dependency scanning, and software supply chain protections.
- Configure, tune, and triage security tools and vulnerability management platforms to reduce false positives and improve developer remediation workflows.
- Partner with product, engineering, platform, privacy, compliance, infrastructure, and security stakeholders to identify and remediate application security risks.
- Conduct threat modeling, security code reviews, and system design reviews covering low-level design, API design, and data modeling.
- Operate AI/ML-enabled security solutions and apply AI/ML concepts to real-world products.
- Apply AI/ML and agentic AI techniques to vulnerability management, including autonomous triage, prioritization, classification, and enrichment.
- Enable developers through secure development guidance, standards, and playbooks while influencing secure engineering decisions.
- Reduce vulnerability backlogs and improve remediation SLAs through automation, tool tuning, and data-driven operational improvements.
Requirements
- Bachelor’s degree in Computer Science or a related technical field, or equivalent related professional experience.
- At least 5 years of relevant professional experience.
- Experience in application security, product security, DevSecOps, or security engineering supporting modern CI/CD pipelines, cloud-native services, and secure software delivery across multiple services or domains.
- Experience with software supply chain security, including SBOMs, signing or attestation, secure build pipelines, SAST, DAST, and SCA.
- Experience operating and tuning vulnerability management and security tooling platforms and integrating them with CI/CD pipelines, ticketing systems, and developer workflows.
- Experience using modern programming languages such as Java or Python to automate security outcomes.
- Preferred experience applying AI/ML and agentic AI techniques to vulnerability management and AI-assisted security tooling.
- Familiarity with AI-driven systems, AI/ML security implications such as the OWASP LLM Top 10, and basic penetration testing concepts.
- Demonstrated ability to enable developers and influence secure engineering decisions through practical guidance, standards, and playbooks.
- Strong communication, judgment, and ambiguity-navigation skills, with the ability to explain complex security topics to technical and non-security audiences.
- Proven success improving vulnerability remediation effectiveness, remediation SLAs, and signal-to-noise ratios.
Benefits
- Medical, dental, and vision coverage.
- Paid time off and an Employee Assistance Program.
- Wellness and travel reimbursement.
- Travel discounts and International Airlines Travel Agent Network (IATAN) membership.
- The position is based in Seattle; compensation varies based on location, budget, and qualifications.
- Expedia Group provides recruiting accommodations for applicants with disabilities.
About Expedia
Expedia Group builds a global online travel marketplace where consumers book flights, hotels, vacation rentals, cars, and activities, and partners distribute and market inventory across its platform. It monetizes through commissions, merchant/agency models, and advertising via brands including Expedia, Hotels.com, and Vrbo. Founded in 1996 and headquartered in Seattle, the public company (NASDAQ: EXPE) serves travelers and partners in more than 70 countries with B2C, B2B, and ad tech offerings.