Lead AppSec Engineer — Build Secure, Scalable Ad Tech

TripleLift; Toronto; On-site; CAD 120,000 - 170,000; Full time

Job summary

TripleLift seeks a Senior Application Security Engineer to drive secure software development across the org. You will partner with Engineering, Platform, Cloud Infrastructure, and Security teams to embed security into design, coding, and deployment of our advertising platforms.

You will lead automated security testing, threat modeling, and vulnerability remediation, while evangelizing best practices and building scalable security tooling for a high-stakes ad-tech environment.

Qualifications

• 5+ years in application security or related field.
• Proficiency with GHAS, SAST, DAST and dependency review.
• Hands-on security testing in CI/CD pipelines.
• Experience with web apps, APIs, and cloud security.
• Knowledge of OWASP Top 10 and common vulnerabilities.
• Ability to perform threat modeling and design reviews.
• Code review across Python, Java, TypeScript, Go.

Responsibilities

• Lead and scale an enterprise-wide application security program.
• Automate security testing in CI/CD and maintain tooling.
• Drive secure coding practices and remediation efforts.
• Perform penetration testing and validate findings.
• Coordinate vulnerability management and risk remediation.
• Collaborate with product/engineering on secure design.
• Develop and deliver secure development training.

Skills

GHAS

SAST

DAST

CI/CD security

Penetration testing

Threat modeling

OWASP Top 10

Programming languages

Education

Bachelor's in CS/InfoSec

Tools

CodeQL

Burp Suite

OWASP ZAP

Snyk

Veracode

Checkmarx

Job description

TripleLift seeks a Senior Application Security Engineer to drive secure software development across the org. You will partner with Engineering, Platform, Cloud Infrastructure, and Security teams to embed security into design, coding, and deployment of our advertising platforms.

You will lead automated security testing, threat modeling, and vulnerability remediation, while evangelizing best practices and building scalable security tooling for a high-stakes ad-tech environment.