Senior AppSec Engineer — Secure SDLC & CI/CD Automation

TripleLift; Greater London; On-site; GBP 92,875 - 122,595; Full time

Benefits offered by this job

Medical, Dental & Vision Plans

Flexible PTO

401k with employer match

Job summary

TripleLift is seeking a Senior Application Security Engineer to advance secure software development and implement a mature application security program. You will partner with Engineering, Platform, Cloud Infrastructure, and Security teams to embed security into CI/CD, tooling, vulnerability remediation, and secure coding practices.

The role emphasizes building secure SDLC processes, conducting penetration testing, and improving security automation across the ad-tech platform.

Qualifications

• 5+ years in application security or similar role.
• Experience with GHAS including SAST, secret scanning & dependency review.
• Proficiency with SAST/DAST/SCA tools and CI/CD integration.
• Hands-on pentesting across web apps, APIs, or cloud.
• Knowledge of OWASP Top 10, CWE and secure coding practices.
• Strong threat modeling & design review abilities.

Responsibilities

• Build and maintain global security compliance program based on NIST CSF.
• Scale application security with automated testing in CI/CD pipelines.
• Champion secure SDLC and remediation activities.
• Automate security testing in pipelines and maintain integrations.
• Drive adoption of GHAS across engineering repos.

Skills

Secure coding practices

CI/CD integration

Threat modeling

Penetration testing

AWS security

Team collaboration

Ownership

Security tooling

Education

OSCP/CISSP/CISA certification

Tools

GHAS

CodeQL

Burp Suite

OWASP ZAP

Snyk

Checkmarx

Veracode

Job description

TripleLift is seeking a Senior Application Security Engineer to advance secure software development and implement a mature application security program. You will partner with Engineering, Platform, Cloud Infrastructure, and Security teams to embed security into CI/CD, tooling, vulnerability remediation, and secure coding practices.

The role emphasizes building secure SDLC processes, conducting penetration testing, and improving security automation across the ad-tech platform.