Application Security Engineer III

At Expedia Group, we help travelers explore the world, one journey at a time. As a global travel company powered by passionate people, trusted partnerships, and leading technology, we connect travelers, partners, and advertisers through our consumer brands, B2B network, and travel advertising business. Here, you'll do meaningful work that helps millions of people discover, book, and experience travel with more ease, confidence, and joy.

Our five Behaviors‑Traveler First, Think Big, Operate with Excellence, Ownership Mindset, and Succeed Together‑help foster a supportive environment where people can grow their careers and have the flexibility, benefits, and support to do their best work. Join us and build for travelers everywhere.

Our Technology Team partners with teams across Expedia Group to create innovative products, services, and tools to deliver high-quality experiences for travelers, partners, and our employees. A singular technology platform powered by data and machine learning provides secure, differentiated, and personalized experiences that drive loyalty and traveler satisfaction. Our Product Security organization is on a mission to transform how cybersecurity is built and delivered at Expedia Group.

We are building the security infrastructure, platforms, and services that empower our engineering teams to ship products faster — with security embedded by default, not bolted on after the fact. We believe that great security accelerates product velocity, and we are looking for a deeply technical, hands‑on individual contributor who will help us architect and realize that vision  you are passionate about reimagining what a modern product security organization looks like — and have the technical depth to make it real — this role is for you.

• Drive shift‑left security practices by embedding security requirements and controls throughout the software development lifecycle, from design through deployment.
• Integrate, maintain, and continuously improve security tooling and automation across CI/CD pipelines, including capabilities such as SAST, DAST, SCA, dependency scanning, and software supply chain protections.
• Configure, tune, and triage security tools and vulnerability management platforms to reduce false positives, improve signal quality, and strengthen remediation workflows for developers.
• Partner closely with product, engineering, platform, privacy, compliance, infrastructure, and security stakeholders to identify, assess, and remediate application security risks across the services and components you support.
• Conduct threat modeling, security code reviews, and system design reviews, including low‑level design, API design, and data modeling, for new and existing features and services.
• Safely integrate and operate AI/ML-enabled solutions that improve security outcomes, applying familiarity with AI‑driven systems, tools, or workflows and applying AI/ML concepts to real world products.

• Bachelor’s degree in Computer Science or a related technical field; or equivalent related professional experience.
• 5+ years of relevant professional experience.
• Experience in application security, product security, Dev Sec Ops , or security engineering supporting modern CI/CD pipelines, cloud-native services, and secure software delivery practices across multiple services or domains.
• Practical experience with software supply chain security, including areas such as SBOMs, signing or attestation, secure build pipelines, and using SAST, DAST, and SCA to protect against open-source and supply chain risks.
• Practical experience operating and tuning vulnerability management and security tooling platforms (e.g., Qualys, SCA, Wiz, GHAS, Ox security, integrating…