Senior Application Security Engineer

Responsibilities

• Play a critical role in building and maintaining a global security compliance program based on NIST CSF.
• Scale application security by developing automated security testing utilizing enterprise SAST, DAST, and code-review tools.
• Champion SDLC to promote secure application development and infrastructure deployment and facilitate secure coding remediation activities.
• Automate security testing in CI/CD pipelines to detect vulnerabilities early, including building and maintaining the pipeline integrations themselves.
• Administer and drive adoption of GitHub Advanced Security (GHAS) : code scanning, secret scanning, and dependency review across engineering repositories.
• Participate in threat modeling and design/architecture spec reviews to identify and mitigate security risks early in the SDLC.
• Coordinate with stakeholders to develop and implement a vulnerability management program and to perform threat-hunting activities.
• Own and conduct internal penetration testing and vulnerability assessments of applications and infrastructure, and validate findings from third-party pentest engagements.
• Monitor and respond to application-layer security threats like API abuses, business logic flaws, and common web vulnerabilities.
• Collaborate with product and engineering teams to ensure security is a key consideration in software design and architecture.
• Enhance application security posture by working with cross-functional teams to implement proper authentication, authorization, and data protection mechanisms.
• Enhance and facilitate security incident handling activities.
• Evangelize security best practices and provide education and awareness to company employees. Develop and implement secure coding guidelines and conduct secure development training for engineers.
• Evaluate and continuously improve the maturity of the security program through the deployment and management of various security tools and processes.

Education & Requirements

• 5 years minimum of experience in application security, secure software development, security engineering, or a similar role.
• Strong understanding of secure coding practices and ability to guide developers on remediation strategies.
• Experience with GitHub Advanced Security (GHAS), including Code Scanning (SAST), Secret Scanning, and Dependency Review.
• Proficiency in SAST, DAST, and SCA tools (e.g., CodeQL, Burp Suite, OWASP ZAP, Snyk, Checkmarx, Veracode).
• Hands-on experience integrating security testing tools into CI/CD pipelines for automated security scanning, including designing and building pipeline workflows.
• Hands-on penetration testing / offensive security experience across web applications, APIs, or cloud infrastructure.
• Knowledge of common application security vulnerabilities and mitigations (OWASP Top 10, CWE, business logic flaws, API security).
• Ability to perform threat modeling and participate in design/architecture spec reviews to assess security risks in applications and services.
• Experience conducting security code reviews across various programming languages (e.g., Python, Java, TypeScript, Go).
• Understanding of security fundamentals with relation to various cybersecurity and compliance frameworks, particularly NIST CSF, but any of PCI, SOC2, HITRUST, ISO 27001/2, or similar.
• Strong understanding of AWS security services and controls (IAM, VPC, KMS, GuardDuty, CloudTrail) and experience securing cloud-native environments and workloads, with the ability to deploy security tools within them.
• Takes ownership of projects, works independently with minimal oversight, and delivers results in a fast-paced environment while balancing multiple priorities.
• Continuously learns, adapts, and values correctness, efficiency, and constructive feedback.
• Preferred:
• Experience in the ad-tech / programmatic advertising industry, or another high-scale, real-time environment.
• Preferred: Familiarity with using AI/LLM-based tools (e.g., Claude or similar) for threat intelligence, alert triage, or security automation.
• Holds a cybersecurity certification, e.g., OSCP, GWAPT, CISSP, CISA, etc.

Life at TripleLift

Establishing People, Culture and Community Initiatives

Privacy Policy