Senior Application Security Engineer

Key details

Full job description

The Senior Application Security Engineer at TripleLift is responsible for driving secure software development and application security maturity. The role involves partnering with Engineering, Platform, Cloud Infrastructure, and Security teams to embed security into product design, build, deployment, and operations. Key responsibilities include building a global security compliance program based on NIST CSF, scaling application security with automated testing (SAST, DAST), championing secure SDLC practices, automating security testing in CI/CD pipelines, administering GitHub Advanced Security tools, participating in threat modeling, managing vulnerability programs, conducting penetration testing and vulnerability assessments, monitoring application-layer security threats, collaborating on secure software design, enhancing authentication and data protection, facilitating incident handling, evangelizing security best practices, and improving security program maturity. Requirements include 5+ years in application security or related roles, strong secure coding knowledge, experience with GHAS and security tools (CodeQL, Burp Suite, OWASP ZAP, Snyk, Checkmarx, Veracode), CI/CD security integration, penetration testing skills, knowledge of OWASP Top 10 and other vulnerabilities, threat modeling experience, security code review skills in multiple languages (Python, Java, TypeScript, Go), understanding of cybersecurity frameworks (NIST CSF, PCI, SOC2, HITRUST, ISO 27001/2), AWS security expertise, and ability to work independently in a fast-paced environment. Preferred qualifications include ad-tech experience, familiarity with AI/LLM tools for security, and cybersecurity certifications such as OSCP, GWAPT, CISSP, or CISA.