Staff Engineer, Application Security
Confirmed on the employer's own hiring board on Oct 28, 2026. First seen by Alion on Aug 30, 2026. ACV Auctions scores A on the Alion truth index.
Who we are looking for:
ACV is looking for an Application Security Engineer to join our security team and lead the development and maturation of our Application Security (AppSec) program. This is a high-impact role for someone with a proven track record of embedding security into modern software development lifecycles in SaaS environments. You’ll work across engineering, product, and DevOps to ensure secure design, implementation, and deployment of our applications and services. This role is ideal for a developer turned security leader who has built or significantly matured an AppSec program from the ground up and is looking to drive impact at scale within a fast-paced, cloud-native, DevSecOps environment.
What you will do:
Actively and consistently support all efforts to simplify and enhance the customer experience.
Design, implement, and scale ACV's Application Security Program, aligning with Secure SDLC best practices and taking a Shift Left by default approach.
Serve as the subject matter expert for secure application architecture, code analysis, and application threat modeling.
Partner with engineering and security teams to integrate security tools and controls into CI/CD pipelines (e.g., SAST, DAST, SCA, secrets management).
Conduct and oversee escalated code reviews, security assessments, and pen testing of internal and external applications.
Lead threat modeling workshops, security training, and awareness initiatives for developers and architects.
Develop policies, standards, and automation to support a secure-by-default engineering culture.
Drive remediation efforts by working hands-on with developers to fix critical vulnerabilities.
Collaborate with compliance and risk teams to meet security audit and regulatory requirements (SOC 2, ISO 27001, etc.).
Stay current on emerging threats, vulnerabilities, and secure development trends.
Perform additional duties as assigned.
What you will need:
Ability to read, write, speak and understand English.
Attention to detail and strong organizational skills
Critical thinking and problem-solving abilities
Effective written and verbal English communication skills
Demonstrated experience building or leading a successful Application Security Program at a technology-driven organization
Deep technical knowledge of common web and mobile vulnerabilities (e.g., OWASP Top 10), microservices security, and cloud-native architectures (preferably AWS)
Strong proficiency with security testing tools (e.g., Burp Suite, GitHub Advanced Security, Snyk, Checkmarx, etc.)
Familiarity with modern development stacks and languages (e.g., Node.js, Python, Go, React).
Hands-on experience securing CI/CD environments and working with DevOps teams
Experience conducting code and security reviews of architecture designs, APIs, and infrastructure-as-code
Strong communication skills with the ability to influence engineers and leadership alike as well as understand that different audiences require different messages
Industry certifications a plus (e.g., OSWE, GWAPT, CSSLP, CISSP)