Director, App Security Engineering – Hybrid

World Wrestling Entertainment, Inc.; New York (NY); Hybrid; USD 143,000 - 190,000; Full time

Job summary

TKO Group Holdings, Inc. is seeking a hands-on Director, Application Security Engineering to strengthen cybersecurity across web, mobile, data, and AI-enabled workflows.

This hybrid role embeds security into delivery practices, working with software engineering, DevOps, and security teams to mature SSDLC, expand guardrails, and enable secure development. 3 days in-office, preference for NYC, Stamford, Orlando, Austin, or Las Vegas.

Qualifications

• Hands-on application security with experience in DevSecOps.
• Ability to implement SSDLC and shift-left practices.
• Experience reviewing code-level vulnerabilities and guiding remediation.
• Familiarity with CI/CD pipelines and secure tooling.

Responsibilities

• Own and evolve application security practices across the SSDLC with developer alignment.
• Operate and improve SAST, SCA, secret scanning, and repository protections.
• Develop secure development enablement for citizen developers and AI-assisted tools.
• Review vulnerabilities, validate findings, and drive remediation plans.
• Conduct threat modelling and security design reviews for new systems and APIs.
• Advise teams on secure coding, authN/authZ, secrets handling, and data protection.
• Improve guardrails for pipelines, containers, and third-party components.
• Mature risk-based vulnerability management and reporting.
• Support secure adoption of AI-assisted development and agentic systems.
• Create standards, playbooks, and documentation to improve consistency.

Skills

Application security

DevSecOps

SAST/SCA tooling

Threat modelling

SSDLC

CI/CD security

Cloud security

AI security

Security design reviews

Tools

SonarQube

Dependabot

GitHub Advanced Security

Job description

TKO Group Holdings, Inc. is seeking a hands-on Director, Application Security Engineering to strengthen cybersecurity across web, mobile, data, and AI-enabled workflows.

This hybrid role embeds security into delivery practices, working with software engineering, DevOps, and security teams to mature SSDLC, expand guardrails, and enable secure development. 3 days in-office, preference for NYC, Stamford, Orlando, Austin, or Las Vegas.