Application security engineer in ad tech

TripleLift; Greater London; On-site; GBP 100,000 - 140,000; Full time

Job summary

TripleLift is seeking a Senior Application Security Engineer to drive secure software development and maturity within Engineering and Security. You will build a global security program based on NIST CSF, scale with automated testing, and promote secure SDLC across CI/CD pipelines.

Responsibilities include threat modeling, vulnerability management, pentest coordination, and educating engineers on secure coding practices while enhancing cloud security and AWS controls.

Qualifications

• 5+ years in application security or secure software development.
• Experience with GHAS, SAST, DAST and SCA tools.
• Strong CI/CD integration and secure SDLC knowledge.
• Hands-on pentesting across web apps, APIs or cloud infra.
• Knowledge of OWASP Top 10 and security vulnerabilities.
• Threat modeling and design review participation.
• Secure coding guidance across languages (Python, Java, TypeScript, Go).
• AWS security controls and cloud-native security experience.

Responsibilities

• Build and maintain a global security program based on NIST CSF.
• Scale application security with automated testing and code-review tools.
• Champion secure SDLC and remediate security defects in CI/CD.
• Automate security testing in CI/CD pipelines and maintain integrations.
• Administer GHAS across engineering repositories.
• Perform threat modeling and design/architecture reviews.
• Lead vulnerability management and third‑party pentest validation.
• Monitor app-layer threats and API security; address business logic flaws.
• Collaborate with product/engineering to bake security into design.
• Develop secure coding guidelines and engineer training.

Skills

GHAS

Code Scanning

SAST

DAST

SCA

CI/CD

Penetration Testing

Threat Modeling

OWASP Top 10

AWS Security

Cloud Security

Secure Coding

Tools

Burp Suite

CodeQL

Veracode

Checkmarx

Snyk

OWASP ZAP

Job description

Описание

The Senior Application Security Engineer plays a critical role in driving secure software development and application security maturity within TripleLift's Engineering and Security organization, directly influencing how we protect our advertising platforms and the trust our publishers and advertisers place in us.

Задачи

Play a critical role in building and maintaining a global security compliance program based on NIST CSF. Scale application security by developing automated security testing utilizing enterprise SAST, DAST, and code-review tools. Champion SDLC to promote secure application development and infrastructure deployment and facilitate secure coding remediation activities. Automate security testing in CI/CD pipelines to detect vulnerabilities early, including building and maintaining the pipeline integrations themselves. Administer and drive adoption of GitHub Advanced Security (GHAS) : code scanning, secret scanning, and dependency review across engineering repositories. Participate in threat modeling and design/architecture spec reviews to identify and mitigate security risks early in the SDLC. Coordinate with stakeholders to develop and implement a vulnerability management program and to perform threat-hunting activities. Own and conduct internal penetration testing and vulnerability assessments of applications and infrastructure, and validate findings from third-party pentest engagements. Monitor and respond to application-layer security threats like API abuses, business logic flaws, and common web vulnerabilities. Collaborate with product and engineering teams to ensure security is a key consideration in software design and architecture. Enhance application security posture by working with cross-functional teams to implement proper authentication, authorization, and data protection mechanisms. Enhance and facilitate security incident handling activities. Evangelize security best practices and provide education and awareness to company employees. Develop and implement secure coding guidelines and conduct secure development training for engineers. Evaluate and continuously improve the maturity of the security program through the deployment and management of various security tools and processes.

Требования

5 years minimum of experience in application security, secure software development, security engineering, or a similar role. Strong understanding of secure coding practices and ability to guide developers on remediation strategies. Experience with GitHub Advanced Security (GHAS), including Code Scanning (SAST), Secret Scanning, and Dependency Review. Proficiency in SAST, DAST, and SCA tools (e.g., CodeQL, Burp Suite, OWASP ZAP, Snyk, Checkmarx, Veracode). Hands‑on experience integrating security testing tools into CI/CD pipelines for automated security scanning, including designing and building pipeline workflows. Hands-on penetration testing / offensive security experience across web applications, APIs, or cloud infrastructure. Knowledge of common application security vulnerabilities and mitigations (OWASP Top 10, CWE, business logic flaws, API security). Ability to perform threat modeling and participate in design/architecture spec reviews to assess security risks in applications and services. Experience conducting security code reviews across various programming languages (e.g., Python, Java, TypeScript, Go). Understanding of security fundamentals with relation to various cybersecurity and compliance frameworks, particularly NIST CSF, but any of PCI, SOC2, HITRUST, ISO 27001/2, or similar. Strong understanding of AWS security services and controls (IAM, VPC, KMS, GuardDuty, CloudTrail) and experience securing cloud-native environments and workloads, with the ability to deploy security tools within them. Takes ownership of projects, works independently with minimal oversight, and delivers results in a fast-paced environment while balancing multiple priorities. Continuously learns, adapts, and values correctness, efficiency, and constructive feedback. Будет плюсом: Experience in the ad-tech / programmatic advertising industry, or another high-scale, real-time environment; Preferred: Familiarity with using AI/LLM-based tools (e.g., Claude or similar) for threat intelligence, alert triage, or security automation; Holds a cybersecurity certification, e.g., OSCP, GWAPT, CISSP, CISA, etc.

Условия

At TripleLift, we’re a team of great people who like who they work with and want to make everyone around them better. This means being positive, collaborative, and compassionate. We hustle harder than the competition and are continuously innovating. We invest in our people and foster a workplace that encourages curiosity, celebrates shared values, and promotes meaningful connections across teams and communities.