Senior Application Security Engineer

Key details

Full job description

The Senior Application Security Engineer will drive secure software development and application security maturity at TripleLift. Responsibilities include building and maintaining a global security compliance program based on NIST CSF, scaling application security with automated testing (SAST, DAST, code-review tools), promoting secure SDLC practices, automating security testing in CI/CD pipelines, administering GitHub Advanced Security features, participating in threat modeling and design reviews, managing vulnerability programs, conducting penetration testing and vulnerability assessments, monitoring application-layer security threats, collaborating with product and engineering teams on security design, enhancing authentication and data protection, facilitating incident handling, evangelizing security best practices, and improving the security program maturity. Requirements include 5+ years in application security or related roles, strong secure coding knowledge, experience with GHAS and security tools (CodeQL, Burp Suite, OWASP ZAP, Snyk, Checkmarx, Veracode), CI/CD integration experience, penetration testing skills, knowledge of OWASP Top 10 and other vulnerabilities, threat modeling, security code reviews in multiple languages (Python, Java, TypeScript, Go), understanding of cybersecurity frameworks (NIST CSF, PCI, SOC2, HITRUST, ISO 27001/2), strong AWS security knowledge, and ability to work independently in a fast-paced environment. Preferred experience includes ad-tech industry knowledge, AI/LLM-based security tools, and cybersecurity certifications (OSCP, GWAPT, CISSP, CISA). Location: London, England, United Kingdom.