Senior AppSec Engineer - CI/CD Security Automation

TripleLift; New York (NY); On-site; USD 180,000 - 230,000; Full time

Job summary

TripleLift in New York seeks a Senior Application Security Engineer to drive secure software development and maturity across engineering and security teams. You will partner with Engineering, Platform, Cloud Infrastructure, and Security to embed secure coding, CI/CD security, and remediation, building a resilient ad-tech platform.

The role emphasizes threat modeling, automated security testing, and education across engineers to raise security standards and resilience.

Qualifications

• 5+ years in application security or related field.
• Experience with secure SDLC and guiding developers on remediation.
• Strong knowledge of SAST/DAST/SCA tools and secure coding practices.
• AWS security services and cloud controls understanding.
• Ability to perform threat modeling and design reviews.

Responsibilities

• Build and scale an application security program across the org.
• Develop automated security testing using enterprise SAST, DAST and code-review tools.
• Automate security testing in CI/CD pipelines and build integrations.
• Administer and drive adoption of GitHub Advanced Security (GHAS).
• Conduct internal penetration testing and vulnerability assessments.
• Monitor and respond to application-layer security threats.
• Collaborate with product and engineering to embed security into design.
• Educate engineers through secure development training and guidelines.
• Improve security program maturity through tools and processes.

Skills

Penetration testing

Application security

Threat modeling

CI/CD security

Security tooling

OWASP Top 10

Secure coding guidance

Engineering collaboration

Tools

GHAS

CodeQL

Burp Suite

OWASP ZAP

Snyk

Checkmarx

Veracode

Job description

TripleLift in New York seeks a Senior Application Security Engineer to drive secure software development and maturity across engineering and security teams. You will partner with Engineering, Platform, Cloud Infrastructure, and Security to embed secure coding, CI/CD security, and remediation, building a resilient ad-tech platform.

The role emphasizes threat modeling, automated security testing, and education across engineers to raise security standards and resilience.