Dependency Review Engineer Jobs

1 job found

1d ago

Senior Application Security Engineer

TripleLift New York, NY

New York, NY

1d ago

$160k - $200k/yr Full time Senior Application Security Code Scanning

Apply Now

Job Description

TripleLift is hiring a Senior Application Security Engineer in New York, NY (onsite) to drive secure software development and raise application security maturity.

Responsibilities

Build and maintain a global security compliance program aligned to NIST CSF.
Scale application security by creating automated security testing using enterprise SAST, DAST, and code review tooling.
Promote secure development through the SDLC, supporting secure coding remediation and secure infrastructure deployment.
Automate security testing within CI/CD pipelines to surface vulnerabilities early, including building and maintaining the pipeline integrations.
Administer and drive adoption of GitHub Advanced Security (GHAS) across engineering repositories, including:
- Code Scanning (SAST)
- Secret Scanning
- Dependency Review
Participate in threat modeling and support design and architecture specification reviews to identify and mitigate risks early in the SDLC.
Coordinate stakeholders to develop and implement a vulnerability management program and perform threat-hunting activities.
Own and conduct internal penetration testing and vulnerability assessments for applications and infrastructure, and validate results from third-party pentest engagements.
Monitor and respond to application-layer security threats including API abuses, business logic flaws, and common web vulnerabilities.
Work with product and engineering teams to ensure security is built into software design and architecture.
Strengthen security posture by implementing appropriate authentication, authorization, and data protection mechanisms with cross-functional partners.
Enhance and support security incident handling activities.
Evangelize security best practices by providing education and awareness for employees, developing secure coding guidelines, and running secure development training.
Evaluate and continuously improve security program maturity by deploying and managing security tools and processes.

Requirements

5 years minimum experience in application security, secure software development, security engineering, or a similar role.
Strong secure coding knowledge, with the ability to guide remediation strategies for developers.
Experience with GitHub Advanced Security (GHAS): Code Scanning (SAST), Secret Scanning, and Dependency Review.
Proficiency with SAST, DAST, and SCA tools, including: CodeQL, Burp Suite, OWASP ZAP, Snyk, Checkmarx, Veracode.
Hands-on experience integrating security testing into CI/CD pipelines, including designing and building pipeline workflows.
Hands-on penetration testing and offensive security experience across web applications, APIs, or cloud infrastructure.
Knowledge of common application security vulnerabilities and mitigations including OWASP Top 10 and CWE, plus business logic flaws and API security.
Ability to perform threat modeling and participate in design/architecture spec reviews to assess security risks.
Experience conducting security code reviews across multiple programming languages, such as Python, Java, TypeScript, and Go.
Security fundamentals knowledge for cybersecurity and compliance frameworks, especially NIST CSF, and exposure to frameworks such as PCI, SOC2, HITRUST, ISO 27001/2, or similar.
Strong understanding of AWS security services and controls (IAM, VPC, KMS, GuardDuty, CloudTrail) and experience securing cloud-native environments and workloads, including deploying security tools within them.
Ownership mindset and ability to work independently with minimal oversight while delivering results in a fast-paced environment and balancing multiple priorities.
Continuous learning approach, with emphasis on correctness, efficiency, and constructive feedback.

Technologies

GitHub Advanced Security (GHAS)
Code Scanning, Secret Scanning, Dependency Review
SAST, DAST, SCA
CodeQL, Burp Suite, OWASP ZAP
Snyk, Checkmarx, Veracode
CI/CD
NIST CSF
OWASP Top 10, CWE
AWS: IAM, VPC, KMS, GuardDuty, CloudTrail
Python, Java, TypeScript, Go
PCI, SOC2, HITRUST, ISO 27001/2
OSCP, GWAPT, CISSP, CISA

Preferred

Experience in the ad-tech / programmatic advertising industry, or another high-scale, real-time environment.
Familiarity with using AI/LLM-based tools (e.g., Claude or similar) for threat intelligence, alert triage, or security automation.
Cybersecurity certification such as OSCP, GWAPT, CISSP, CISA, etc.

Compensation

USD 160,000 - 200,000 per year

Life at TripleLift

Collaborative, positive, and compassionate team culture.
Continuous innovation and fast-paced execution.
Focus on helping each other improve.

People, Culture and Community Initiatives

Culture focused on feeling connected, supported, and empowered.
Invest in people, encourage curiosity, celebrate shared values, and foster meaningful connections across teams and communities.
Commitment to hiring and belonging across backgrounds, viewpoints, and experiences.
Emphasis on creating an environment where people can thrive and feel a sense of belonging.

View full job page →

Get Dependency Review Engineer Jobs alerts

New Dependency Review Engineer Jobs, daily.