Application Security Engineer II

## Responsibilities - Secure the software and applications that Credit Acceptance builds, buys, and operates. - Partner with engineering, product, architecture, and business teams to ensure applications handling sensitive consumer, dealer, and loan data are designed, developed, and deployed securely, meeting internal security standards and regulatory expectations. - Embed security into the software development lifecycle by providing hands-on technical guidance, performing threat modeling and application security reviews, defining secure design patterns and guardrails, and supporting engineering teams in building and maintaining modern web, mobile, API, and cloud-based applications. - Work from home; occasional planned travel to an assigned Southfield, Michigan office location may be required. - Perform security reviews of applications and services at each stage of the SDLC, including design, code, building pipelines, dependencies, infrastructure-as-code, and third-party components. - Identify and mitigate risks such as injection, authentication/authorization flaws, insecure handling of NPI, PII, and payment data, open-source dependency vulnerabilities, insecure cloud configurations, secrets management, and exposed APIs. - Support threat modeling and risk assessments for new and existing applications, assisting teams in implementing practical mitigations. - Assess and help mitigate security risks introduced by AI-assisted and agentic development tools, including review of AI-generated code, exposure of source code or secrets to external models, and proper use of internal LLM gateways. ## Requirements - Customer Empathy: Ability to understand the perspectives, pain points, and experiences of customers. - Engineering Excellence: Bring great craftsmanship and thought leadership to deliver an outstanding product that delights customers and solves for the business. - One Team: Collaborative approach across the organization, working together seamlessly as a single, cohesive team. ## Nice to Have - Experience with AI-assisted development tools and agentic coding workflows. - Familiarity with regulatory and industry frameworks such as PCI DSS, GLBA, NIST SSDF, SOX. - Experience with application security tooling (SAST, DAST, SCA, IAST, secrets scanning, ASPM) and vendors. ## Benefits - Great Place to Work culture. - Flexible work environment. - Professional development and continuous improvement opportunities. - Casual work environment. - Work-life balance.