> Markdown version of [/jobs/ext/4630003-staff-engineer-application-security](https://www.wearedevelopers.com/jobs/ext/4630003-staff-engineer-application-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Staff Engineer, Application Security

- **Company:** ACV Auctions
- **Location:** Buffalo, NY, United States
- **Contract:** Permanent contract
- **Skills:** Application Programming Interfaces (APIs), Amazon Web Services, Software System Penetration Testing, Burp Suite, Cloud Engineering, Static Program Analysis, Code Review, Continuous Integration, DevOps, Github, Python (Programming Language), Key Management, Node.Js, Open Web Application Security, Systems Development Life Cycle, Information Technology Security Auditing, ReactJS, Sonatype, Software Security, GWAPT, Checkmarx, Static Application Security Testing, Golang, Microservices, Dynamic Application Security Testing
- **Published:** November 7, 2026
- **Apply:** https://www.careerbuilder.com/job-details/staff-engineer-application-security-buffalo-ny--438f8fc6-d12f-4126-9100-7da77e41f6f3

## About the Role

Applications Security, Team Player, Technical Support, Sales, Automotive Industry, Automotive Sales, eCommerce Sales, Health Plan, Legal, Regulations, * Ability to read, write, speak and understand English.

 * Attention to detail and strong organizational skills
 * Critical thinking and problem-solving abilities
 * Effective written and verbal English communication skills
 * Demonstrated experience building or leading a successful Application Security Program at a technology-driven organization
 * Deep technical knowledge of common web and mobile vulnerabilities (e.g., OWASP Top 10), microservices security, and cloud-native architectures (preferably AWS)
 * Strong proficiency with security testing tools (e.g., Burp Suite, GitHub Advanced Security, Snyk, Checkmarx, etc.)
 * Familiarity with modern development stacks and languages (e.g., Node.js, Python, Go, React).
 * Hands-on experience securing CI/CD environments and working with DevOps teams
 * Experience conducting code and security reviews of architecture designs, APIs, and infrastructure-as-code
 * Strong communication skills with the ability to influence engineers and leadership alike as well as understand that different audiences require different messages
 * Industry certifications a plus (e.g., OSWE, GWAPT, CSSLP, CISSP)

#LI-AM3, Compensation: The compensation range for this position is listed in the "Job Details" section at the bottom of this posting. Please note that final compensation will be determined based upon the applicants relevant experience, skill set, location, business needs, market demands, and other factors as permitted by law.

## Description

* Actively and consistently support all efforts to simplify and enhance the customer experience.
 * Design, implement, and scale ACVs Application Security Program, aligning with Secure SDLC best practices and taking a Shift Left by default approach.
 * Serve as the subject matter expert for secure application architecture, code analysis, and application threat modeling.
 * Partner with engineering and security teams to integrate security tools and controls into CI/CD pipelines (e.g., SAST, DAST, SCA, secrets management).
 * Conduct and oversee escalated code reviews, security assessments, and pen testing of internal and external applications.
 * Lead threat modeling workshops, security training, and awareness initiatives for developers and architects.
 * Develop policies, standards, and automation to support a secure-by-default engineering culture.
 * Drive remediation efforts by working hands-on with developers to fix critical vulnerabilities.
 * Collaborate with compliance and risk teams to meet security audit and regulatory requirements (SOC 2, ISO 27001, etc.).
 * Stay current on emerging threats, vulnerabilities, and secure development trends.
 * Perform additional duties as assigned.