Dependency Scanning

Dependency Scanning Cybersecurity Jobs

2 jobs found

2d ago

Senior Application Security Engineer

TripleLift Hoboken, NJ

Hoboken, NJ

2d ago

$160k - $200k/yr Full time Senior Application Security Code Scanning

Apply Now

Job Description

TripleLift is hiring a Senior Application Security Engineer to strengthen secure software development across engineering, platform, cloud infrastructure, and security.

Responsibilities

Build and maintain a global security compliance program aligned to NIST CSF.
Scale application security by developing automated security testing using enterprise SAST, DAST, and code-review tools.
Promote an SDLC that supports secure application development and infrastructure deployment, including secure coding remediation activities.
Automate security testing in CI/CD pipelines to detect vulnerabilities early, including building and maintaining the pipeline integrations.
Administer and drive adoption of GitHub Advanced Security (GHAS) across engineering repositories, including:
- Code scanning
- Secret scanning
- Dependency review
Participate in threat modeling and design or architecture specification reviews to identify and mitigate risks early in the SDLC.
Coordinate stakeholders to develop and implement a vulnerability management program and support threat-hunting activities.
Own and conduct internal penetration testing and vulnerability assessments for applications and infrastructure, and validate outcomes from third-party pentest engagements.
Monitor and respond to application-layer threats, including API abuse, business logic flaws, and common web vulnerabilities.
Collaborate with product and engineering teams to ensure security is built into software design and architecture.
Improve application security posture by implementing authentication, authorization, and data protection mechanisms.
Enhance and facilitate security incident handling activities.
Evangelize security best practices by providing education and awareness for employees; develop and implement secure coding guidelines and run secure development training for engineers.
Evaluate and continuously improve security program maturity by deploying and managing security tools and processes.

Requirements

5 years minimum experience in application security, secure software development, security engineering, or a related role.
Strong understanding of secure coding practices and ability to guide developers through remediation strategies.
Experience with GitHub Advanced Security (GHAS) including:
- Code Scanning (SAST)
- Secret Scanning
- Dependency Review
Proficiency with SAST, DAST, and SCA tools (examples include CodeQL, Burp Suite, OWASP ZAP, Snyk, Checkmarx, Veracode).
Hands-on experience integrating security testing tools into CI/CD pipelines for automated scanning, including designing and building pipeline workflows.
Hands-on penetration testing and offensive security experience across web applications, APIs, or cloud infrastructure.
Knowledge of common application security vulnerabilities and mitigations including OWASP Top 10 and CWE, with a focus on business logic flaws and API security.
Ability to perform threat modeling and participate in design or architecture spec reviews to assess security risks.
Experience conducting security code reviews across programming languages such as Python, Java, TypeScript, and Go.
Security fundamentals mapped to cybersecurity and compliance frameworks, especially NIST CSF (also includes PCI, SOC2, HITRUST, ISO 27001/2, or similar).
Strong understanding of AWS security services and controls (including IAM, VPC, KMS, GuardDuty, CloudTrail) and experience securing cloud-native environments and workloads, including deploying security tools within them.
Ownership mindset with the ability to work independently with minimal oversight, delivering results in a fast-paced environment while balancing multiple priorities.
Continually learns and adapts, valuing correctness, efficiency, and constructive feedback.

Technologies

NIST CSF
GitHub Advanced Security (GHAS): Code Scanning, Secret Scanning, Dependency Review
SAST, DAST, SCA
CodeQL, Burp Suite, OWASP ZAP, Snyk, Checkmarx, Veracode
CI/CD
OWASP Top 10, CWE
Python, Java, TypeScript, Go
PCI, SOC2, HITRUST, ISO 27001/2
AWS: IAM, VPC, KMS, GuardDuty, CloudTrail
OSCP, GWAPT, CISSP, CISA
Claude

Preferred

Experience in ad-tech or programmatic advertising, or another high-scale real-time environment.
Familiarity with using AI/LLM-based tools (for example, Claude or similar) for threat intelligence, alert triage, or security automation.
Cybersecurity certification such as OSCP, GWAPT, CISSP, CISA, etc.

Location and Compensation

Location: Hoboken, NJ (onsite)
Salary: USD 160,000 - 200,000 per year

Life at TripleLift

Team culture focused on people who like who they work with and aim to help everyone around them improve.
Continuous innovation and fast-moving execution.
Learn more via TripleLift’s LinkedIn Life page.

People, Culture and Community Initiatives

Commitment to building a culture that helps people feel connected, supported, and empowered.
Investment in employees and encouragement of curiosity, shared values, and meaningful connections across teams and communities.
Focus on ensuring talent of every background, viewpoint, and experience can be hired, belong, and develop.
People, Culture, and Community initiatives designed to help everyone thrive and feel a sense of belonging.

Privacy Policy

See TripleLift and 1plusX websites for Privacy Policies.
TripleLift does not accept unsolicited resumes from recruitment search firms.

View full job page →

2mo ago

Principal Application Security Architect - 861

Quantinuum Broomfield, CO

Broomfield, CO

2mo ago Closed

$184k - $230k/yr Full time Api Security Application Security Cloud Platforms

This position is no longer accepting applications (closed Aug 25, 2026).

Job Description

Quantinuum offers a competitive salary range of USD 184,000 to 230,000 per year, a flexible work schedule, and a comprehensive benefits package that includes health, dental, and vision insurance, a 401(k) match, student loan repayment assistance, equity, paid holidays, generous vacation, sick time, paid parental leave, and employee discounts. This onsite role in Broomfield, CO provides the chance to serve as the hands-on technical lead for the security and architectural integrity of the application ecosystem, defining secure architectures, guiding assessments, and building tooling.

Responsibilities

Perform manual code reviews to uncover logic flaws and vulnerabilities that automated scanners may miss.
Lead hands-on threat modeling sessions for complex systems to establish security requirements before coding begins.
Conduct targeted technical testing of web services, APIs, and cloud workloads to verify defenses perform as intended.
Architect and manage the enterprise scanning ecosystem, including tuning SAST, DAST, and dependency scanning tools for high-quality results.
Build and maintain security gates directly within CI/CD pipelines to provide developers with fast, actionable feedback.
Collaborate with engineering teams to review pull requests and ensure security fixes are technically sound and effective.
Create Golden Patterns for authentication, encryption, and data handling to guide secure development roadmaps.
Ensure compliance with regulatory frameworks such as CIS CSC18, NIST CSF, ISO27001, GDPR, and SOC 2.
Establish technical standards for identifying and prioritizing vulnerabilities by real-world exploitability and business impact.
Partner with product and engineering teams to design secure architectures for new applications and major feature releases.
Serve as the organization’s primary subject matter expert on application security tools, modern attack methods, and defensive coding.
Translate complex vulnerabilities into clear business risks for technical teams and executive stakeholders.
Stay current with emerging threats, vulnerabilities, and security technologies.
Drive automation in security testing and monitoring and contribute to the evolution of enterprise application security strategy.

Requirements

Bachelor's degree minimum.
At least 10 years of experience in application security, penetration testing, or secure software development.
At least 5 years of hands-on software engineering experience.
Due to contractual requirements, must be a U.S. Person defined as a U.S. citizen, permanent resident or green card holder, or asylee/refugee status.
National security requirements restrict candidates who are nationals of the PRC or Russia unless the candidate is also a U.S. citizen.

Technologies

Java, Python, JavaScript, Go
SAST, DAST, and dependency scanning tools
CI/CD pipelines
AWS, Azure, GCP

We value

Bachelor's degree in computer science, cybersecurity, information systems, or a related field, or equivalent work experience.
Strong technical knowledge of OWASP Top 10, SANS CWE, and secure coding practices.
Fluency in at least two modern programming languages such as Java, Python, JavaScript, or Go.
Hands-on experience building and tuning enterprise-grade SAST and DAST processes.
Expert knowledge of cloud-native application security across AWS, Azure, and GCP.
Professional certifications such as CISSP, CSSLP, OSCP, or GWAPT are preferred.
Excellent analytical, problem-solving, collaboration, and communication skills.

View full job page →

Dependency Scanning Cybersecurity Jobs

Senior Application Security Engineer

Principal Application Security Architect - 861

Get Dependency Scanning Cybersecurity Jobs alerts