When you hire someone, you do so because you expect that they provide value to your company. What are your expectations for your Application Security Engineer?
If you answered "To make our product more secure", then it seems to me that you have not really thought too much about security. Perhaps it's also not your area of expertise, which is fine too. We all started at some point.
Ask yourself, what do you actually want this person to do? Are you looking for someone who finds flaws and suggest reactive measures? Or are you looking for someone who improves your processes and overall code architecture to improve your security proactively?
Once you have settled for what you actually want the future employee to provide for your company, ask yourself how their skill set fits into this. For instance, if you are dealing with a codebase that is very broken due to no existing security knowledge at all, then perhaps someone who has good experience building secure architectures may be a good option.
But don't be discouraged if a future employee does not 100% fit the role you had hoped for them to do. People evolve, and if you actively aim to getting this employee where you want them to have (e.g. by offering them specialized training, sending them to conferences, etc.), then you will inevitably end up with someone very valuable to your company infrastructure.
I know that "It depends on what you want" is not the answer you may have hoped for. It certainly would have seemed to be much easier if I had listed a number of skills and certifications that person would need to have, but ultimately this isn't the way you would want to go.