Director, Secure SDLC & AI-Driven Development

UFC GYM; New York (NY); Hybrid; USD 180,000 - 240,000; Full time

Job summary

TKO Group Holdings, Inc. is seeking a hands‑on Director of Application Security Engineering to strengthen cybersecurity and embed security into software delivery across web, mobile, data, and AI workflows.

This hybrid role requires collaboration with engineering, DevOps, architecture, QA, and compliance teams to mature SSDLC practices, expand guardrails, and drive risk-based remediation across modern and legacy environments.

Qualifications

• 5+ years of hands-on experience in application security, product security, DevSecOps, or related security engineering.
• Experience collaborating with engineering teams in fast-moving delivery environments.
• Hands-on experience configuring and operating SAST/SCA tooling.

Responsibilities

• Own and evolve SSDLC practices with scalable, developer-aligned controls.
• Operate and improve SAST, SCA, secret scanning, and code scanning in CI/CD pipelines.
• Provide secure development guidance for tooling, identity, observability, and data protection.
• Review vulnerabilities, validate findings, and drive risk-based remediation plans.
• Conduct threat modeling and security design reviews for new systems and APIs.
• Advise teams on secure coding, authN/authZ, secrets handling, and data protection.
• Improve guardrails for build pipelines, containers, APIs, and third-party components.
• Support secure adoption of AI-assisted development and agentic systems.

Skills

Application security

DevSecOps

SSDLC

Threat modeling

Vulnerability management

SAST/SCA tooling

Code review

CI/CD integration

Cloud security

AI security considerations

Tools

SonarQube

Dependabot

GitHub

GitHub Advanced Security

Job description

TKO Group Holdings, Inc. is seeking a hands‑on Director of Application Security Engineering to strengthen cybersecurity and embed security into software delivery across web, mobile, data, and AI workflows.

This hybrid role requires collaboration with engineering, DevOps, architecture, QA, and compliance teams to mature SSDLC practices, expand guardrails, and drive risk-based remediation across modern and legacy environments.