Director of Application Security Engineering

Ultimate Fighting Championship; New York (NY); Hybrid; USD 142,500 - 190,000; Full time

Benefits offered by this job

Health care

Retirement plan

Paid time off

Job summary

TKO Group Holdings, Inc. is seeking a hands-on Director, Application Security Engineering to strengthen our cybersecurity posture and partner with teams building software across web, mobile, data, and AI-enabled workflows.

This hybrid role embeds security into delivery, expands guardrails, and matures secure SDLC practices. You will collaborate across engineering, platform, DevOps, architecture, QA, and compliance to ensure secure design and risk-based remediation.

Qualifications

• 5+ years in application security or security engineering roles.
• Experience with SSDLC and shift-left practices.
• Experience configuring and operating SAST, SCA, and related tooling.
• Ability to provide actionable remediation guidance to engineers.
• Familiarity with CI/CD pipelines and developer workflows.

Responsibilities

• Own and evolve SSDLC security controls across pipelines and repos.
• Operate and improve SAST, SCA, secret scanning, and code scanning.
• Develop secure development enablement for AI-assisted development.
• Review vulnerabilities and drive risk-based remediation plans.
• Conduct threat modeling and security design reviews for new systems.
• Advise teams on secure coding, auth, secrets handling, and data protection.
• Improve guardrails for pipelines, containers, and deployment practices.
• Support risk-based vulnerability management and reporting.

Skills

AppSec experience

SSDLC

Threat modeling

Remediation guidance

DevSecOps

AI security

Cloud & CI/CD

Security design reviews

Code review

Tools

SonarQube

Dependabot

GitHub

GitHub Advanced Security

Code scanning

Job description

TKO Group Holdings, Inc. is seeking a hands-on Director, Application Security Engineering to strengthen our cybersecurity posture and partner with teams building software across web, mobile, data, and AI-enabled workflows.

This hybrid role embeds security into delivery, expands guardrails, and matures secure SDLC practices. You will collaborate across engineering, platform, DevOps, architecture, QA, and compliance to ensure secure design and risk-based remediation.