Lead AppSec Engineer: Tooling & Threat Modeling

The Trade Desk; Denver (CO); On-site; USD 113,500 - 208,100; Full time

Job summary

The Trade Desk in Denver is seeking a Senior Application Security Engineer to join our Cybersecurity Department. You will own tooling, lead threat modeling, and harden the application security program across a platform used daily by the world’s largest brands.

The right candidate brings deep application security expertise, strong software development instincts, and a bias to action. You will partner with engineers and product teams, translate risk into actionable guidance, and help scale a

Qualifications

• BS degree or equivalent years of experience in related field.
• 6-8+ years in application security with a track record of building tooling and automation.
• Active software development experience in at least one: C#, Java, Python, Go, or JavaScript.
• Hands-on experience with SAST, DAST, SCA, and secrets management tooling and CI/CD integration.
• Practical threat modeling experience (STRIDE, PASTA, or equivalent).
• Experience with vulnerability management workflows: triage, prioritization, and remediation at scale.
• Working knowledge of Kubernetes and container security, and cloud fundamentals (AWS, GCP, or Azure).
• Experience in AI/ML security is a plus.

Responsibilities

• Extend and own scalable AppSec tooling across core areas including SAST/DAST and threat modeling.
• Triage and reproduce scanner output, contextualize risk for engineers, and explain customer impact.
• Conduct security-focused code reviews and application-layer penetration tests.
• Write production-quality security automation and tooling alongside guidance.
• Secure AI/ML systems and build AI-augmented tooling to scale output.
• Advise on secure-by-design patterns and drive security governance frameworks.

Skills

Application security

Threat modeling

Code reviews

Secure coding

SAST/DAST

CI/CD tooling

Security automation

Communication

Education

BS degree in related field

Tools

GitHub Actions

GitLab

Jenkins

ArgoCD

Job description

The Trade Desk in Denver is seeking a Senior Application Security Engineer to join our Cybersecurity Department. You will own tooling, lead threat modeling, and harden the application security program across a platform used daily by the world’s largest brands.

The right candidate brings deep application security expertise, strong software development instincts, and a bias to action. You will partner with engineers and product teams, translate risk into actionable guidance, and help scale a