{"id":2622949,"url":"https://alion.io/job/liquidity-services-application-security-engineer-iii","title":"Application Security Engineer III","company":{"id":7799,"name":"Liquidity Services","domain":"liquidityservices.com","url":"https://alion.io/company/liquidity-services","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"inferred_payroll_markers","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":106800,"max":133500,"currency":"USD","period":"year","gross":null,"usd_annual":133500},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agile","optional":false},{"name":"Angular","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Bicep","optional":false},{"name":"C#","optional":false},{"name":"ChatGPT","optional":false},{"name":"CI/CD","optional":false},{"name":"Claude","optional":false},{"name":"CloudFormation","optional":false},{"name":"Copilot","optional":false},{"name":"Cursor","optional":false},{"name":"Dependabot","optional":false},{"name":"DNS","optional":false},{"name":"Docker","optional":false},{"name":"GCP","optional":false},{"name":"Git","optional":false},{"name":"GitHub","optional":false},{"name":"GraphQL","optional":false},{"name":"HashiCorp Vault","optional":false},{"name":"JavaScript","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Dependency-Check","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PCI DSS","optional":false},{"name":"PowerShell","optional":false},{"name":"pre-commit","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"SBOM","optional":false},{"name":"SonarQube","optional":false},{"name":"SQL","optional":false},{"name":"Terraform","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"Vault","optional":false}],"status":"live","first_seen_at":"2026-10-15T11:26:41Z","employer_posted_date":"2026-10-15","last_verified_at":"2026-10-16T10:09:02Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"The application security engineer will be responsible for establishing and enforcing security standards and best practices within the organization. They will conduct regular security assessments, identify vulnerabilities, and work with internal and external teams to remediate them. They also keep up to date with the latest security threats, trends, and countermeasures to ensure that the organization's applications are always protected.\n Security Testing: Perform penetration testing, vulnerability scanning, and manual and automated secure code reviews, including reviews of AI-generated code where applicable.\nThreat Modeling: Analyze system designs to identify potential attack vectors and risks before deployment.\nDeveloper Collaboration: Bridge the gap between security and engineering teams by advising on secure coding standards, such as the OWASP Top 10.\nTool Automation: Configure and manage Web Application Firewalls (WAFs), CI/CD security pipelines, and automated scanning tools.\nIdentity and Access Security: Manage security considerations related to SSO, SAML/OIDC, OAuth, MFA, service accounts, privileged access, and least-privilege principles.\nSecure SDLC Governance: Define secure design reviews, security gates, release approvals, exception-handling processes, and remediation tracking.\nSoftware Supply Chain Security: Oversee Software Composition Analysis (SCA), SBOM generation and review, open-source dependency risk management, package repository security, artifact signing and verification, and third-party component security reviews.\nSecurity Architecture Reviews: Review application and cloud architectures during the design phase, identify security risks before implementation, and define compensating controls and secure design patterns.\nAI and Emerging Technology Security: Promote the secure use of AI coding assistants, review AI-generated code, protect sensitive information in AI workflows, and assess AI-related security risks.\nVulnerability Management: Manage vulnerability triage, risk ratings, remediation deadlines, false-positive handling, retesting, and reporting.\nData Protection and Privacy by Design: Support the secure handling of PII, encryption, retention, data minimization, privacy impact awareness, and regulatory expectations.\nPayment Security: Secure payment integrations, assess PCI DSS scope, and review vendor AOCs and payment-provider security responsibilities.\nIncident Response: Support application security logging, alerting, forensic readiness, incident response, and post-incident corrective actions.\n Education/ Experience:\nMinimum 5+ years of experience in application security, secure software development, penetration testing, or DevSecOps security.\nExperience influencing engineering teams and driving remediation efforts across multiple development teams.\nDeep knowledge of AWS, Azure, or GCP, including how to secure their services.\nSolid understanding of DNS, HTTP, cookies, sessions, TLS, and browser security controls.\nKnowledge of threat modeling, secure code reviews, and the Secure Software Development Life Cycle (SSDLC).\nKnowledge of version control (Git), containerization (Docker), and automated testing integration.\nKnowledge of pipeline permissions, secrets in builds, branch protection, deployment approvals, artifact integrity, and code signing.\nExperience using AI-assisted development tools (e.g., Claude, GitHub Copilot, ChatGPT, Cursor, Amazon Q, or similar) to improve productivity while maintaining code quality and security.\nAbility to critically review, validate, and test AI-generated code rather than accepting generated outputs without verification.\nUnderstanding of the security, privacy, and intellectual property considerations associated with AI-assisted software development.\nPractical understanding of container security where Docker or Kubernetes are used, including securing container images through approved base images and vulnerability scanning in CI/CD.\nKnowledge of securing REST and GraphQL APIs against OWASP API Security Top 10 risks, including broken authentication, excessive data exposure, lack of rate limiting, and injection attacks.\nExperience implementing API gateways, OAuth 2.0, and API key rotation policies.\nExperience reviewing and securing Infrastructure as Code used to deploy and manage cloud services across AWS and Azure environments, including Terraform, CloudFormation, ARM/Bicep, or similar templates.\nPractical experience preventing hardcoded credentials in source code and pipelines.\nKnowledge of secrets managers, including AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, and Google Secret Manager, and automated secrets scanning in pre-commit hooks and CI/CD.\nStrong ability to read, review, and write code in the languages used across the environment, including:\nJavaScript/TypeScript for web applications and front-end services\nC#/.NET for Microsoft-based services and integrations\nJava for enterprise or legacy applications\nAJAX, Angular, and REACT for Front-End Web Development Technologies\nPython and PowerShell for automation, scripting, security tooling, and operational workflows\nSQL for secure database interaction and query review\nExperience with code security and dependency management tools such as:\nClaude Security\nCoPilot Security\nGitHub Dependabot\nGitHub Advanced Security\nSonarQube\nOWASP Dependency-Check\nSimilar SAST, DAST, SCA, and secret-scanning tools\nDesired Certifications:\nCISSP: Certified Information Systems Security Professional\nCSSLP: Certified Secure Software Lifecycle Professional\nCASE: Certified Application Security Engineer\nOSCP / OSWE: Offensive Security credentialsSkills and Ability: \n\nStrong communication to influence developers and stakeholders on remediation priorities.\nAbility to clearly explain security flaws and fixes to software developers.\nStrong teamwork skills to integrate security into fast-paced agile development cycles.\nCritical thinking to analyze complex codebases and anticipate how attackers might exploit.\nWork Conditions/ Physical Demands:\nThis position is primarily performed in a home office or other approved remote work environment. The employee is expected to maintain a safe, secure, and distraction-free workspace with reliable internet access. Duties primarily involve prolonged periods of sitting, working on a computer, and communicating via phone and video conferencing.\nThe employee must be able to frequently use a computer, keyboard, mouse, and other standard office equipment, as well as communicate effectively with colleagues, customers, and business partners. Occasional lifting of office materials or equipment up to 15 pounds may be required.\nTravel:\nOccasional travel may be required for meetings, training, or business needs (up to 10%).\nPay & Benefits:\nCompensation is determined by various factors such as location, education, knowledge, skills, competencies, and experience, as well as internal and external equity and organizational needs. Additionally, this role is eligible for an annual discretionary bonus.\nThe salary range for this position is $106,800 to $133,500 annually. The posted range reflects our national average range for the job. We may ultimately pay more or less than the published range based on the factors mentioned above. This range may be modified in the future.\nAt Liquidity Services, we provide a comprehensive benefits package that supports our employees' well-being and provides growth opportunities and career development. Our offerings include:\nCompetitive wages\nHealthcare (medical, dental, vision, prescription drugs, FSAs)\n401(k) plan\nPaid time off (PTO) and holidays\nPaid parental leave\nLife and disability insurance\nEmployee Assistance Program (EAP)\nProfessional development and tuition assistance\nDisclaimer: The above statements are intended to describe the general nature and level of work being performed. They are not intended to be construed as an exhaustive list of all responsibilities, duties and skills required of personnel so classified. Liquidity Services Inc. reserves the right to modify position duties at any time due to business necessity.\nLiquidity Services is an Equal Opportunity Employer.","description_format":"text","description_chars":8171,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Growth opportunities","Home office","Parental leave","Professional development"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Commerce","Auctions","Marketplaces"],"lifecycle":[{"event":"open","at":"2026-10-15T14:07:42Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 6 · green card filings: 1","filings_12m":6,"filings_prev_12m":5,"green_card_filings_12m":1,"median_offered_wage_usd":128214,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":1}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":73,"reasons":["conf:0","win:early"],"computed_at":"2026-10-16T05:45:00Z"},"pay":{"stated_usd_annual":133500,"is_top_pay":true},"html_url":"https://alion.io/job/liquidity-services-application-security-engineer-iii","json_url":"https://alion.io/job/liquidity-services-application-security-engineer-iii.json","meta":{"generated_at":"2026-10-16T11:58:37Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11045,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-17T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":7799},"rest":"https://alion.io/mcp/rest/get_company?id=7799"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fliquidity-services-application-security-engineer-iii"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fliquidity-services-application-security-engineer-iii"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fliquidity-services-application-security-engineer-iii"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/liquidity-services-application-security-engineer-iii\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fliquidity-services-application-security-engineer-iii"}]}