Security Engineer , Application Security

Job Summary

At Expedia Group, we help travelers explore the world, one journey at a time. As a global travel company powered by passionate people, trusted partnerships, and leading technology, we connect travelers, partners, and advertisers through our consumer brands, B2B network, and travel advertising business.

Here, youll do meaningful work that helps millions of people discover, book, and experience travel with more ease, confidence, and joy. Our five Behaviors-Traveler First, Think Big, Operate with Excellence, Ownership Mindset, and Succeed Together-help foster a supportive environment where people can grow their careers and have the flexibility, benefits, and support to do their best work. Join us and build for travelers everywhere.

Job Title

Security Engineer-II, Application Security

Responsibilities

• Identify, assess, and help remediate application security vulnerabilities across software development and delivery workflows.
• Partner with engineering and product teams to embed secure-by-design practices throughout the software development lifecycle.
• Perform security reviews, threat modeling, and risk analysis for applications, services, APIs, and data flows.
• Integrate, maintain, and continuously improve security tooling and automation across CI/CD pipelines, including capabilities such as SAST, DAST, SCA, dependency scanning, and software supply chain protections.
• Participate in security design reviews alongside senior engineers, helping identify risks in API design, data models and system architecture, and recommend fixes based on application security principles.
• Safely integrate and operate AI/ML-enabled solutions that improve application security outcomes, while applying AI/ML concepts to real-world products and workflows.

Minimum Qualifications

• Bachelor s degree in computer science, information security, engineering, or a related technical field, or equivalent practical experience.
• 2+ Experience in application security, software engineering, cybersecurity, or a related technical discipline.
• Familiarity with how vulnerabilities are identified, assessed and fixed in applications, such as priority based triaging or verifying a fix.
• Working knowledge of common web and API vulnerabilities (e.g., OWASP Top 10) and how to prevent them.
• Ability to read code, identify security issues, and explain them clearly to developers.

Preferred Qualifications

• Hands-on experience identifying vulnerabilities in web applications or APIs, through code review, testing tools such as Burp Suite, CTFs, bug bounty programs or personal projects
• Experience writing scripts or small tools to automate an application security task, such as running a scanner in CI/CD, parsing and triaging scan results, or writing a custom SAST rule (e.g., Semgrep or CodeQL)
• Exposure to threat modeling or secure design concepts, such as authentication, authorisation, input validation and data protection.
• Familiarity with triaging SAST, SCA or secrets-scanning findings, including telling true positives from false positives.
• Hands-on experience building AI-powered applications, such as LLM-based tools, agents or automation workflows, through work, internships, personal projects or open source.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.