The application security engineer will be responsible for establishing and
enforcing security standards and best practices within the organization. They
will conduct regular security assessments, identify vulnerabilities, and work
with internal and external teams to remediate them. They also keep up to date
with the latest security threats, trends, and countermeasures to ensure that the
organization's applications are always protected.
RESPONSIBILITIES
Security Testing: Perform penetration testing, vulnerability scanning, and
manual and automated secure code reviews, including reviews of AI-generated
code where applicable.
Threat Modeling: Analyze system designs to identify potential attack vectors
and risks before deployment.
Developer Collaboration: Bridge the gap between security and engineering
teams by advising on secure coding standards, such as the OWASP Top 10.
Tool Automation: Configure and manage Web Application Firewalls (WAFs), CI/CD
security pipelines, and automated scanning tools.
Identity and Access Security: Manage security considerations related to SSO,
SAML/OIDC, OAuth, MFA, service accounts, privileged access, and
least-privilege principles.
Secure SDLC Governance: Define secure design reviews, security gates, release
approvals, exception-handling processes, and remediation tracking.
Software Supply Chain Security: Oversee Software Composition Analysis (SCA),
SBOM generation and review, open-source dependency risk management, package
repository security, artifact signing and verification, and third-party
component security reviews.
Security Architecture Reviews: Review application and cloud architectures
during the design phase, identify security risks before implementation, and
define compensating controls and secure design patterns.
AI and Emerging Technology Security: Promote the secure use of AI coding
assistants, review AI-generated code, protect sensitive information in AI
workflows, and assess AI-related security risks.
Vulnerability Management: Manage vulnerability triage, risk ratings,
remediation deadlines, false-positive handling, retesting, and reporting.
Data Protection and Privacy by Design: Support the secure handling of PII,
encryption, retention, data minimization, privacy impact awareness, and
regulatory expectations.
Payment Security: Secure payment integrations, assess PCI DSS scope, and
review vendor AOCs and payment-provider security responsibilities.
Incident Response: Support application security logging, alerting, forensic
readiness, incident response, and post-incident corrective actions.
QUALIFICATIONS
Education/ Experience:
Minimum 5+ years of experience in application security, secure software
development, penetration testing, or DevSecOps security.
Experience influencing engineering teams and driving remediation efforts
across multiple development teams.
Deep knowledge of AWS, Azure, or GCP, including how to secure their services.
Solid understanding of DNS, HTTP, cookies, sessions, TLS, and browser
security controls.
Knowledge of threat modeling, secure code reviews, and the Secure Software
Development Life Cycle (SSDLC).
Knowledge of version control (Git), containerization (Docker), and automated
testing integration.
Knowledge of pipeline permissions, secrets in builds, branch protection,
deployment approvals, artifact integrity, and code signing.
Experience using AI-assisted development tools (e.g., Claude, GitHub Copilot,
ChatGPT, Cursor, Amazon Q, or similar) to improve productivity while
maintaining code quality and security.
Ability to critically review, validate, and test AI-generated code rather
than accepting generated outputs without verification.
Understanding of the security, privacy, and intellectual property
considerations associated with AI-assisted software development.
Practical understanding of container security where Docker or Kubernetes are
used, including securing container images through approved base images and
vulnerability scanning in CI/CD.
Knowledge of securing REST and GraphQL APIs against OWASP API Security Top 10
risks, including broken authentication, excessive data exposure, lack of rate
limiting, and injection attacks.
Experience implementing API gateways, OAuth 2.0, and API key rotation
policies.
Experience reviewing and securing Infrastructure as Code used to deploy and
manage cloud services across AWS and Azure environments, including Terraform,
CloudFormation, ARM/Bicep, or similar templates.
Practical experience preventing hardcoded credentials in source code and
pipelines.
Knowledge of secrets managers, including AWS Secrets Manager, Azure Key
Vault, HashiCorp Vault, and Google Secret Manager, and automated secrets
scanning in pre-commit hooks and CI/CD.
Strong ability to read, review, and write code in the languages used across the
environment, including:
JavaScript/TypeScript for web applications and front-end services
C#/.NET for Microsoft-based services and integrations
Java for enterprise or legacy applications
AJAX, Angular, and REACT for Front-End Web Development Technologies
Python and PowerShell for automation, scripting, security tooling, and
operational workflows
SQL for secure database interaction and query review
Experience with code security and dependency management tools such as:
Claude Security
CoPilot Security
GitHub Dependabot
GitHub Advanced Security
SonarQube
OWASP Dependency-Check
Similar SAST, DAST, SCA, and secret-scanning tools
Desired Certifications:
CISSP: Certified Information Systems Security Professional
CSSLP: Certified Secure Software Lifecycle Professional
CASE: Certified Application Security Engineer
OSCP / OSWE: Offensive Security credentials
Skills and Ability:
Strong communication to influence developers and stakeholders on remediation
priorities.
Ability to clearly explain security flaws and fixes to software developers.
Strong teamwork skills to integrate security into fast-paced agile
development cycles.
Critical thinking to analyze complex codebases and anticipate how attackers
might exploit.
Work Conditions/ Physical Demands:
This position is primarily performed in a home office or other approved
remote work environment. The employee is expected to maintain a safe, secure,
and distraction-free workspace with reliable internet access. Duties
primarily involve prolonged periods of sitting, working on a computer, and
communicating via phone and video conferencing.
The employee must be able to frequently use a computer, keyboard, mouse, and
other standard office equipment, as well as communicate effectively with
colleagues, customers, and business partners. Occasional lifting of office
materials or equipment up to 15 pounds may be required.
Travel:
Occasional travel may be required for meetings, training, or business needs
(up to 10%).
Pay & Benefits:
Compensation is determined by various factors such as location, education,
knowledge, skills, competencies, and experience, as well as internal and
external equity and organizational needs. Additionally, this role is eligible
for an annual discretionary bonus.
The salary range for this position is $106,800 to $133,500 annually. The posted
range reflects our national average range for the job. We may ultimately pay
more or less than the published range based on the factors mentioned above. This
range may be modified in the future.
At Liquidity Services, we provide a comprehensive benefits package that supports
our employees' well-being and provides growth opportunities and career
development. Our offerings include:
Competitive wages
Healthcare (medical, dental, vision, prescription drugs, FSAs)
401(k) plan
Paid time off (PTO) and holidays
Paid parental leave
Life and disability insurance
Employee Assistance Program (EAP)
Professional development and tuition assistance
Disclaimer: The above statements are intended to describe the general nature and
level of work being performed. They are not intended to be construed as an
exhaustive list of all responsibilities, duties and skills required of personnel
so classified. Liquidity Services Inc. reserves the right to modify position
duties at any time due to business necessity.
Liquidity Services is an Equal Opportunity Employer.
Liquidity Services [https://liquidityservices.com/] (NASDAQ: LQDT) operates the
world’s largest B2B e-commerce marketplace platform for surplus assets, with
over $15 billion in completed transactions to more than 6 million qualified
buyers worldwide and 15,000 corporate and government sellers. It supports its
clients’ sustainability efforts by helping them extend the life of assets,
prevent unnecessary waste and carbon emissions, and reduce the number of
products headed to landfills.