Application Security Engineer II

Credit Acceptance is an award-winning company recognized for its workplace culture and commitment to professional development. The Application Security Engineer is responsible for securing software and applications, ensuring they meet internal security standards and regulatory expectations, while collaborating with various teams throughout the software development lifecycle.

Responsibilities:

• Partner with engineering and architecture teams to design and review application architectures (web, mobile, API, and microservices) for security, privacy, and regulatory compliance
• Perform security reviews of applications and services at each stage of the SDLC, including design, code, building pipelines, dependencies, infrastructure‑as‑code, and third‑party components
• Identify and mitigate risks such as:
• Injection, authentication/authorization, injection and session management flaws (OWASP Top 10, ASVS)
• Insecure handling of NPI, PII, and payment data
• Management of open‑source dependency vulnerabilities and software supply chain risks
• Insecure cloud configurations, secrets management, and exposed APIs
• Support threat modeling and risk assessments for new and existing applications, assisting teams in implementing practical mitigations
• Assess and help mitigate security risks introduced by AI‑assisted and agentic development tools (e.g., GitHub Copilot, Claude Code, LiteLLM), including review of AI‑generated code, exposure of source code or secrets to external models, and proper use of internal LLM gateways
• Contribute to and operationalize application security standards, secure coding guidelines, and secure design patterns used across the company
• Evaluate application security tooling (SAST, DAST, SCA, IAST, secrets scanning, ASPM) and vendors to ensure alignment with security, privacy, and compliance requirements
• Support compliance with regulatory and industry frameworks (e.g., PCI DSS, GLBA, NIST SSDF, SOX) in collaboration with legal, compliance, audit, and risk partners
• Contribute to standards and guardrails for secure use of AI‑assisted development tools and agentic coding workflows
• Act as a trusted security advisor to Engineering, Product, and DevOps teams building, maintaining and operating applications at Credit Acceptance
• Participate in design reviews, sprint planning, and architecture working sessions focused on secure development and deployment
• Provide guidance on the secure use of frameworks, libraries, APIs, authentication systems, and cloud services that interact with company systems and data
• Advise engineering teams on safe adoption of AI coding assistants and agentic development tools, including approved usage patterns, data handling expectations, and review of AI‑generated changes
• Stay current on application security threats, vulnerabilities, and best practices, including emerging risks across web, mobile, API, and cloud‑native applications
• Recommend improvements to tooling, processes, and controls to strengthen the company's application security posture and shift security left in the SDLC
• Contribute to internal documentation, secure coding training, and security enablement for developers and engineering teams

Requirements:

• Bachelor's Degree or equivalent experience
• 3+ years of experience in application security, product security, or secure software development
• 2+ years of hands‑on experience performing application security reviews, penetration testing, threat modeling, or secure code review
• Experience securing modern web, mobile, and API‑based applications in a regulated industry (e.g., financial services, healthcare)
• Familiarity with the OWASP Top 10, OWASP ASVS, and OWASP SAMM, and with software supply chain frameworks such as SLSA
• Experience with cloud platforms (e.g., AWS, Azure, GCP) and containerized environments
• Knowledge of regulatory and compliance considerations relevant to financial services (e.g., PCI DSS, GLBA, SOX)
• Experience embedding security into software development workflows (DevSecOps) and CI/CD pipelines
• Hands‑on experience with application security tooling such as SAST, DAST, SCA, IAST, secrets scanning, or ASPM platforms
• Relevant certifications (e.g., GWAPT, GWEB, OSWE, CSSLP, CISSP) a plus
• Familiarity with security considerations for AI‑assisted development environments (e.g., GitHub Copilot, Claude Code) and LLM gateway/proxy tooling (e.g., LiteLLM)