Application Security Engineer

Liquidity Services

. Perform penetration testing, vulnerability scanning, and manual and automated secure code reviews, including reviews of AI-generated code .

Posted 10/15/2026full-timeRemote • United StatesMid-LevelSenior💰 $106,800 - $133,500 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in application security, secure software development, and penetration testing, with a strong focus on threat modeling and secure coding practices. Proficient in managing security for cloud environments and implementing security measures for AI-assisted development.

Highest-signal resume keywords

Application SecurityPenetration TestingThreat ModelingSecure Software Development Life Cycle (SSDLC)AWS Security

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

JavaScriptTypeScriptC#JavaPythonDockerKubernetesAPI SecuritySecure Code ReviewsVulnerability Scanning

Soft Skills

CommunicationTeamworkCritical Thinking

Tools & Technologies

GitAWSAzureGCPOWASPSonarQubeGitHub CopilotClaudeTerraformCloudFormation

Certifications & Qualifications

CISSPCSSLPCASEOSCPOSWE

Industry Keywords

OWASP Top 10MFASAMLOAuthPIIPCI DSSData MinimizationIncident ResponseForensic ReadinessSecurity Gates

Tech Stack

Tools & technologies

AngularAWSAzureCloudDNSDockerFirewallsGoogle Cloud PlatformGraphQLJavaJavaScriptKubernetesPythonReactSDLCSQLTerraformTypeScriptVault.NET

About the role

Key responsibilities & impact

Perform penetration testing, vulnerability scanning, and manual and automated secure code reviews, including reviews of AI-generated code
Analyze system designs to identify potential attack vectors and risks before deployment through threat modeling
Advise engineering teams on secure coding standards, including the OWASP Top 10
Configure and manage Web Application Firewalls, CI/CD security pipelines, and automated scanning tools
Manage security considerations for SSO, SAML/OIDC, OAuth, MFA, service accounts, privileged access, and least-privilege principles
Define secure design reviews, security gates, release approvals, exception-handling processes, and remediation tracking
Oversee software composition analysis, SBOM generation and review, open-source dependency risk management, package repository security, artifact signing and verification, and third-party component security reviews
Review application and cloud architectures, identify security risks, and define compensating controls and secure design patterns
Promote secure use of AI coding assistants, review AI-generated code, protect sensitive information in AI workflows, and assess AI-related security risks
Manage vulnerability triage, risk ratings, remediation deadlines, false-positive handling, retesting, and reporting
Support secure handling of PII, encryption, retention, data minimization, privacy impact awareness, and regulatory expectations
Secure payment integrations, assess PCI DSS scope, and review vendor AOCs and payment-provider security responsibilities
Support application security logging, alerting, forensic readiness, incident response, and post-incident corrective actions
Collaborate with internal and external teams to identify and remediate vulnerabilities
Keep current with security threats, trends, and countermeasures

Requirements

What you’ll need

Minimum 5+ years of experience in application security, secure software development, penetration testing, or DevSecOps security
Experience influencing engineering teams and driving remediation efforts across multiple development teams
Deep knowledge of AWS, Azure, or GCP, including how to secure their services
Solid understanding of DNS, HTTP, cookies, sessions, TLS, and browser security controls
Knowledge of threat modeling, secure code reviews, and the Secure Software Development Life Cycle (SSDLC)
Knowledge of version control (Git), containerization (Docker), and automated testing integration
Knowledge of pipeline permissions, secrets in builds, branch protection, deployment approvals, artifact integrity, and code signing
Experience using AI-assisted development tools such as Claude, GitHub Copilot, ChatGPT, Cursor, Amazon Q, or similar
Ability to critically review, validate, and test AI-generated code
Understanding of security, privacy, and intellectual property considerations associated with AI-assisted software development
Practical understanding of container security where Docker or Kubernetes are used
Knowledge of securing REST and GraphQL APIs against OWASP API Security Top 10 risks
Experience implementing API gateways, OAuth 2.0, and API key rotation policies
Experience reviewing and securing Infrastructure as Code across AWS and Azure environments, including Terraform, CloudFormation, ARM/Bicep, or similar templates
Practical experience preventing hardcoded credentials in source code and pipelines
Knowledge of AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, Google Secret Manager, and automated secrets scanning
Strong ability to read, review, and write JavaScript/TypeScript, C#/.NET, Java, AJAX, Angular, React, Python, PowerShell, and SQL
Experience with Claude Security, CoPilot Security, GitHub Dependabot, GitHub Advanced Security, SonarQube, OWASP Dependency-Check, or similar SAST, DAST, SCA, and secret-scanning tools
Desired certifications include CISSP, CSSLP, CASE, OSCP, or OSWE
Strong communication, teamwork, and critical-thinking skills
Ability to maintain a safe, secure, and distraction-free remote workspace with reliable internet access
Ability to use standard office equipment and occasionally lift up to 15 pounds

Benefits

Comp & perks

Competitive wages
Healthcare (medical, dental, vision, prescription drugs, FSAs)
401(k) plan
Paid time off (PTO) and holidays
Paid parental leave
Life and disability insurance
Employee Assistance Program (EAP)
Professional development and tuition assistance
Annual discretionary bonus
Remote work environment
Occasional travel may be required for meetings, training, or business needs (up to 10%)