{"id":3081057,"url":"https://alion.io/job/acv-auctions-staff-engineer-application-security","title":"Staff Engineer, Application Security","company":{"id":179324,"name":"ACV Auctions","domain":"acvauctions.com","url":"https://alion.io/company/acv-auctions","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Dayforce","truth_index":{"grade":"A","score":95,"open_postings":17,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":78,"computed_at":"2026-10-28T05:59:10Z"}},"role":"Backend","role_family":"Backend","seniority":"staff","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Buffalo, United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":162000,"max_usd":276000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":512},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Burp Suite","optional":false},{"name":"Checkmarx","optional":false},{"name":"CI/CD","optional":false},{"name":"GitHub","optional":false},{"name":"Go","optional":false},{"name":"ISO 27001","optional":false},{"name":"Node JS","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Python","optional":false},{"name":"React.js","optional":false},{"name":"Shift-Left Security","optional":false},{"name":"Snyk","optional":false},{"name":"SOC 2","optional":false},{"name":"Threat Modeling","optional":false},{"name":"JavaScript","optional":true}],"status":"live","first_seen_at":"2026-08-30T04:00:00Z","employer_posted_date":"2026-10-22","last_verified_at":"2026-10-28T17:57:02Z","board_verified":true,"closed_at":null,"days_open":59,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":59},"description":"Who we are looking for:\nACV is looking for an Application Security Engineer to join our security team and lead the development and maturation of our Application Security (AppSec) program. This is a high-impact role for someone with a proven track record of embedding security into modern software development lifecycles in SaaS environments. You’ll work across engineering, product, and DevOps to ensure secure design, implementation, and deployment of our applications and services. This role is ideal for a developer turned security leader who has built or significantly matured an AppSec program from the ground up and is looking to drive impact at scale within a fast-paced, cloud-native, DevSecOps environment.\n\nWhat you will do:\nActively and consistently support all efforts to simplify and enhance the customer experience.\nDesign, implement, and scale ACV's Application Security Program, aligning with Secure SDLC best practices and taking a Shift Left by default approach.\nServe as the subject matter expert for secure application architecture, code analysis, and application threat modeling.\nPartner with engineering and security teams to integrate security tools and controls into CI/CD pipelines (e.g., SAST, DAST, SCA, secrets management).\nConduct and oversee escalated code reviews, security assessments, and pen testing of internal and external applications.\nLead threat modeling workshops, security training, and awareness initiatives for developers and architects.\nDevelop policies, standards, and automation to support a secure-by-default engineering culture.\nDrive remediation efforts by working hands-on with developers to fix critical vulnerabilities.\nCollaborate with compliance and risk teams to meet security audit and regulatory requirements (SOC 2, ISO 27001, etc.).\nStay current on emerging threats, vulnerabilities, and secure development trends.\nPerform additional duties as assigned.\nWhat you will need:\nAbility to read, write, speak and understand English.\nAttention to detail and strong organizational skills\nCritical thinking and problem-solving abilities\nEffective written and verbal English communication skills\nDemonstrated experience building or leading a successful Application Security Program at a technology-driven organization\nDeep technical knowledge of common web and mobile vulnerabilities (e.g., OWASP Top 10), microservices security, and cloud-native architectures (preferably AWS)\nStrong proficiency with security testing tools (e.g., Burp Suite, GitHub Advanced Security, Snyk, Checkmarx, etc.)\nFamiliarity with modern development stacks and languages (e.g., Node.js, Python, Go, React).\nHands-on experience securing CI/CD environments and working with DevOps teams\nExperience conducting code and security reviews of architecture designs, APIs, and infrastructure-as-code\nStrong communication skills with the ability to influence engineers and leadership alike as well as understand that different audiences require different messages\nIndustry certifications a plus (e.g., OSWE, GWAPT, CSSLP, CISSP)","description_format":"text","description_chars":3047,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Upper-Intermediate (B2)","optional":false}]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Auctions","Marketplaces"],"lifecycle":[{"event":"open","at":"2026-10-22T12:09:46Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 4","filings_12m":4,"filings_prev_12m":6,"green_card_filings_12m":0,"median_offered_wage_usd":82500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":65,"band":"ok","label":"Likely open","p_open":1,"p_active":0.86,"p_room":0.75,"age_days":59,"expected_fill_days":78,"reasons":["conf:1","win:late"],"computed_at":"2026-10-28T05:59:10Z"},"pay":null,"html_url":"https://alion.io/job/acv-auctions-staff-engineer-application-security","json_url":"https://alion.io/job/acv-auctions-staff-engineer-application-security.json","meta":{"generated_at":"2026-10-28T19:34:17Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":27099,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-29T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":179324},"rest":"https://alion.io/mcp/rest/get_company?id=179324"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Facv-auctions-staff-engineer-application-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Facv-auctions-staff-engineer-application-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Facv-auctions-staff-engineer-application-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/acv-auctions-staff-engineer-application-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Facv-auctions-staff-engineer-application-security"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3081057}},{"tool":"search_jobs","arguments":{"company":"acvauctions.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3081057},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}