Senior Application Security Engineer

TripleLift is hiring a Senior Application Security Engineer in New York, NY (onsite) to drive secure software development and raise application security maturity.

Responsibilities

• Build and maintain a global security compliance program aligned to NIST CSF.
• Scale application security by creating automated security testing using enterprise SAST, DAST, and code review tooling.
• Promote secure development through the SDLC, supporting secure coding remediation and secure infrastructure deployment.
• Automate security testing within CI/CD pipelines to surface vulnerabilities early, including building and maintaining the pipeline integrations.
• Administer and drive adoption of GitHub Advanced Security (GHAS) across engineering repositories, including:
  • Code Scanning (SAST)
  • Secret Scanning
  • Dependency Review
• Participate in threat modeling and support design and architecture specification reviews to identify and mitigate risks early in the SDLC.
• Coordinate stakeholders to develop and implement a vulnerability management program and perform threat-hunting activities.
• Own and conduct internal penetration testing and vulnerability assessments for applications and infrastructure, and validate results from third-party pentest engagements.
• Monitor and respond to application-layer security threats including API abuses, business logic flaws, and common web vulnerabilities.
• Work with product and engineering teams to ensure security is built into software design and architecture.
• Strengthen security posture by implementing appropriate authentication, authorization, and data protection mechanisms with cross-functional partners.
• Enhance and support security incident handling activities.
• Evangelize security best practices by providing education and awareness for employees, developing secure coding guidelines, and running secure development training.
• Evaluate and continuously improve security program maturity by deploying and managing security tools and processes.

Requirements

• 5 years minimum experience in application security, secure software development, security engineering, or a similar role.
• Strong secure coding knowledge, with the ability to guide remediation strategies for developers.
• Experience with GitHub Advanced Security (GHAS): Code Scanning (SAST), Secret Scanning, and Dependency Review.
• Proficiency with SAST, DAST, and SCA tools, including: CodeQL, Burp Suite, OWASP ZAP, Snyk, Checkmarx, Veracode.
• Hands-on experience integrating security testing into CI/CD pipelines, including designing and building pipeline workflows.
• Hands-on penetration testing and offensive security experience across web applications, APIs, or cloud infrastructure.
• Knowledge of common application security vulnerabilities and mitigations including OWASP Top 10 and CWE, plus business logic flaws and API security.
• Ability to perform threat modeling and participate in design/architecture spec reviews to assess security risks.
• Experience conducting security code reviews across multiple programming languages, such as Python, Java, TypeScript, and Go.
• Security fundamentals knowledge for cybersecurity and compliance frameworks, especially NIST CSF, and exposure to frameworks such as PCI, SOC2, HITRUST, ISO 27001/2, or similar.
• Strong understanding of AWS security services and controls (IAM, VPC, KMS, GuardDuty, CloudTrail) and experience securing cloud-native environments and workloads, including deploying security tools within them.
• Ownership mindset and ability to work independently with minimal oversight while delivering results in a fast-paced environment and balancing multiple priorities.
• Continuous learning approach, with emphasis on correctness, efficiency, and constructive feedback.

Technologies

• GitHub Advanced Security (GHAS)
• Code Scanning, Secret Scanning, Dependency Review
• SAST, DAST, SCA
• CodeQL, Burp Suite, OWASP ZAP
• Snyk, Checkmarx, Veracode
• CI/CD
• NIST CSF
• OWASP Top 10, CWE
• AWS: IAM, VPC, KMS, GuardDuty, CloudTrail
• Python, Java, TypeScript, Go
• PCI, SOC2, HITRUST, ISO 27001/2
• OSCP, GWAPT, CISSP, CISA

Preferred

• Experience in the ad-tech / programmatic advertising industry, or another high-scale, real-time environment.
• Familiarity with using AI/LLM-based tools (e.g., Claude or similar) for threat intelligence, alert triage, or security automation.
• Cybersecurity certification such as OSCP, GWAPT, CISSP, CISA, etc.

Compensation

• USD 160,000 - 200,000 per year

Life at TripleLift

• Collaborative, positive, and compassionate team culture.
• Continuous innovation and fast-paced execution.
• Focus on helping each other improve.

People, Culture and Community Initiatives

• Culture focused on feeling connected, supported, and empowered.
• Invest in people, encourage curiosity, celebrate shared values, and foster meaningful connections across teams and communities.
• Commitment to hiring and belonging across backgrounds, viewpoints, and experiences.
• Emphasis on creating an environment where people can thrive and feel a sense of belonging.