Senior Application Security Engineer

TripleLift is hiring a Senior Application Security Engineer to strengthen secure software development across engineering, platform, cloud infrastructure, and security.

Responsibilities

• Build and maintain a global security compliance program aligned to NIST CSF.
• Scale application security by developing automated security testing using enterprise SAST, DAST, and code-review tools.
• Promote an SDLC that supports secure application development and infrastructure deployment, including secure coding remediation activities.
• Automate security testing in CI/CD pipelines to detect vulnerabilities early, including building and maintaining the pipeline integrations.
• Administer and drive adoption of GitHub Advanced Security (GHAS) across engineering repositories, including:
  • Code scanning
  • Secret scanning
  • Dependency review
• Participate in threat modeling and design or architecture specification reviews to identify and mitigate risks early in the SDLC.
• Coordinate stakeholders to develop and implement a vulnerability management program and support threat-hunting activities.
• Own and conduct internal penetration testing and vulnerability assessments for applications and infrastructure, and validate outcomes from third-party pentest engagements.
• Monitor and respond to application-layer threats, including API abuse, business logic flaws, and common web vulnerabilities.
• Collaborate with product and engineering teams to ensure security is built into software design and architecture.
• Improve application security posture by implementing authentication, authorization, and data protection mechanisms.
• Enhance and facilitate security incident handling activities.
• Evangelize security best practices by providing education and awareness for employees; develop and implement secure coding guidelines and run secure development training for engineers.
• Evaluate and continuously improve security program maturity by deploying and managing security tools and processes.

Requirements

• 5 years minimum experience in application security, secure software development, security engineering, or a related role.
• Strong understanding of secure coding practices and ability to guide developers through remediation strategies.
• Experience with GitHub Advanced Security (GHAS) including:
  • Code Scanning (SAST)
  • Secret Scanning
  • Dependency Review
• Proficiency with SAST, DAST, and SCA tools (examples include CodeQL, Burp Suite, OWASP ZAP, Snyk, Checkmarx, Veracode).
• Hands-on experience integrating security testing tools into CI/CD pipelines for automated scanning, including designing and building pipeline workflows.
• Hands-on penetration testing and offensive security experience across web applications, APIs, or cloud infrastructure.
• Knowledge of common application security vulnerabilities and mitigations including OWASP Top 10 and CWE, with a focus on business logic flaws and API security.
• Ability to perform threat modeling and participate in design or architecture spec reviews to assess security risks.
• Experience conducting security code reviews across programming languages such as Python, Java, TypeScript, and Go.
• Security fundamentals mapped to cybersecurity and compliance frameworks, especially NIST CSF (also includes PCI, SOC2, HITRUST, ISO 27001/2, or similar).
• Strong understanding of AWS security services and controls (including IAM, VPC, KMS, GuardDuty, CloudTrail) and experience securing cloud-native environments and workloads, including deploying security tools within them.
• Ownership mindset with the ability to work independently with minimal oversight, delivering results in a fast-paced environment while balancing multiple priorities.
• Continually learns and adapts, valuing correctness, efficiency, and constructive feedback.

Technologies

• NIST CSF
• GitHub Advanced Security (GHAS): Code Scanning, Secret Scanning, Dependency Review
• SAST, DAST, SCA
• CodeQL, Burp Suite, OWASP ZAP, Snyk, Checkmarx, Veracode
• CI/CD
• OWASP Top 10, CWE
• Python, Java, TypeScript, Go
• PCI, SOC2, HITRUST, ISO 27001/2
• AWS: IAM, VPC, KMS, GuardDuty, CloudTrail
• OSCP, GWAPT, CISSP, CISA
• Claude

Preferred

• Experience in ad-tech or programmatic advertising, or another high-scale real-time environment.
• Familiarity with using AI/LLM-based tools (for example, Claude or similar) for threat intelligence, alert triage, or security automation.
• Cybersecurity certification such as OSCP, GWAPT, CISSP, CISA, etc.

Location and Compensation

• Location: Hoboken, NJ (onsite)
• Salary: USD 160,000 - 200,000 per year

Life at TripleLift

• Team culture focused on people who like who they work with and aim to help everyone around them improve.
• Continuous innovation and fast-moving execution.
• Learn more via TripleLift’s LinkedIn Life page.

People, Culture and Community Initiatives

• Commitment to building a culture that helps people feel connected, supported, and empowered.
• Investment in employees and encouragement of curiosity, shared values, and meaningful connections across teams and communities.
• Focus on ensuring talent of every background, viewpoint, and experience can be hired, belong, and develop.
• People, Culture, and Community initiatives designed to help everyone thrive and feel a sense of belonging.

Privacy Policy

• See TripleLift and 1plusX websites for Privacy Policies.
• TripleLift does not accept unsolicited resumes from recruitment search firms.