Senior Manager, Application Vulnerability Validation & Verification - USDS

TikTok USDS Joint Venture; San Jose (CA); On-site; USD 200,000 - 442,000; Full time

Job summary

TikTok USDS Joint Venture LLC seeks a Senior Manager to architect and lead its Application Vulnerability Validation team in San Jose. You will own strategy, headcount, and cross-functional collaboration across U.S.

and global product lines to ensure vulnerabilities are validated in production environments. You will build and drive advanced automation, LLM-assisted triage, and a scalable internal platform to minimize false positives and accelerate secure software delivery.

Qualifications

• Proven AppSec leadership with impact in security engineering or product security roles.
• Strong proficiency in Python, Go, Java, or JavaScript for automation and tooling.
• Deep familiarity with enterprise SAST/DAST/SCA platforms (Checkmarx, Veracode, Burp Suite, Snyk, GHAS).
• Understanding of microservices, CI/CD, Kubernetes, API gateways, and modern software architectures.

Responsibilities

• Hire, mentor, and technically direct a high-performing AppSec engineering team.
• Architect and drive automated AppSec pipelines and triage tooling to reduce false positives.
• Oversee in-depth vulnerability verification across web, mobile, and API surfaces.
• Collaborate with US and global teams to implement systemic mitigations and security guidance.

Skills

AppSec Leadership

Scripting Fluency

Security Tooling

Cloud & Microservices

Tools

Checkmarx

Veracode

Burp Suite Enterprise

Snyk

GitHub Advanced Security

Job description

Responsibilities

About the Team

The Validation and Verification (VnV) organization ensures the security and reliability of our products by validating that security controls are implemented correctly, operating effectively, and delivering measurable risk reduction across the enterprise.

VnV operates across a continuous security lifecycle: Prevent – Assure – Test – Fix – Prove, ensuring that security posture is not only designed and tested, but continuously validated in real-world conditions.

We are seeking a Senior Manager to architect, scale, and lead our Application Vulnerability Validation team based in San Jose.

This is a highly strategic leadership position, moving far beyond administrative backlog management. Your organization serves as the definitive validation layer for code safety. Your team will ingest raw telemetry from SAST, DAST, and SCA tooling to answer the critical questions: Is this vulnerability exploitable in production, and does it present a viable path for an attacker?

In this role, you will balance two primary strategic pillars:

• Deep Technical Execution: Leading a specialized engineering team in manual vulnerability validation, proof-of-concept development, and complex attack-path mapping across web, mobile, and API surfaces.
• Engineering & Automation: Designing the automation and tooling strategy required to scale this function. Leveraging advanced workflows and agentic AI to minimize false positives at the source and convert expert human judgment into reusable code.

You will report directly to Validation and Verification leadership, maintain full ownership of the strategy and headcount for this software assurance function, and partner across U.S. and global engineering product lines.

Responsibilities

• Team Leadership & Capability Building: Hire, mentor, and technically direct a high-performing team of Application Security engineers. Establish rigorous operational standards and define the benchmark for technical excellence within the function.
• Automation & Next-Generation Triage: Drive the strategy and hands-on development of our automated AppSec pipeline. Architect custom tooling, scanner-API integrations, and LLM-assisted triage systems to drastically accelerate analysis and eliminate false positives before they require human intervention.
• Advanced Vulnerability Verification: Oversee deep-dive technical analysis across web, mobile (iOS/Android), and API endpoints, ensuring the team moves beyond automated scanner outputs to confirm true production exploitability.
• Attack Path & Blast Radius Analysis: Drive contextual, systemic analysis of how vulnerabilities chain across a massive software supply chain, proactively identifying risks to sensitive data or critical infrastructure.
• Cross-Functional Collaboration: Build durable, collaborative relationships with U.S. and global engineering product teams to implement strategic, systemic mitigations rather than temporary patches.
• Technical Advisory: Serve as a principal internal consultant, providing precise, actionable, and architecturally sound secure-coding guidance to product and platform teams.

Qualifications

Minimum Qualifications

• Proven AppSec Leadership: A demonstrable track record of leadership within Application Security, Product Security, or Software Security Engineering. We prioritize the depth, technical complexity, and impact of what you have built over strict year counts; however, successful candidates typically bring 5 years of domain experience, including formal team management.
• Engineering & Scripting Fluency: Strong proficiency in software development and scripting (Python, Go, Java, or JavaScript) to interface with scanner APIs and build scalable internal automation platforms.
• Tooling & Ecosystem Expertise: Deep familiarity with orchestrating and optimizing enterprise SAST/DAST/SCA platforms (e.g., Checkmarx, Veracode, Burp Suite Enterprise, Snyk, GitHub Advanced Security).
• Modern Architecture Literacy: A strong conceptual and practical understanding of microservices, service mesh, CI/CD pipelines, Kubernetes, Docker, and API gateways.

Preferred Qualifications

• Advanced technical certifications demonstrating deep hands-on expertise (e.g., OSWE, OSWA, GWE, CASE, CSSLP).
• Experience navigating massive, highly distributed architectures and coordinating remediation across multi-national engineering organizations.
• Experience utilizing formal threat modeling frameworks on complex features to proactively map systemic risk.
• Exceptional communication and influence skills—the ability to resolve engineering misalignment by presenting objective, contextualized threat evidence.

About USDS

TikTok USDS Joint Venture LLC is dedicated to the safety and security of millions of Americans who create, discover, and connect with what they love on the apps we operate. The Joint Venture has been established in compliance with the Executive Order signed by President Trump on September 25, 2025. Our foundation is a comprehensive data privacy and cybersecurity program we operate under defined safeguards to protect national security and secure U.S. user data, apps and the algorithm. We safeguard the U.S. content ecosystem, holding decision- making authority for trust and safety policies and moderation. USDS Joint Venture helps ensure Americans can continue to express their creativity, discover new hobbies and interests, and build thriving communities and businesses on a global scale.

On-site presence across teams allows the company to operate with greater speed, alignment, and agility — especially in areas like real-time decision-making, team development, and integrated execution. As such, the company is shifting from a hybrid work model to a fully in-person schedule up to 5 days a week.

Why Join Us

Inspiring creativity is at the core of TikTok's mission. Our innovative product is built to help people authentically express themselves, discover and connect – and our global, diverse teams make that possible. Together, we create value for our communities, inspire creativity and bring joy - a mission we work towards every day.

We strive to do great things with great people. We lead with curiosity, humility, and a desire to make impact in a rapidly growing tech company. Every challenge is an opportunity to learn and innovate as one team. We're resilient and embrace challenges as they come. By constantly iterating and fostering an "Always Day 1" mindset, we achieve meaningful breakthroughs for ourselves, our company, and our users. When we create and grow together, the possibilities are limitless. Join us.

Diversity & Inclusion

TikTok is committed to creating an inclusive space where employees are valued for their skills, experiences, and unique perspectives. Our platform connects people from across the globe and so does our workplace. At TikTok, our mission is to inspire creativity and bring joy. To achieve that goal, we are committed to celebrating our diverse voices and to creating an environment that reflects the many communities we reach. We are passionate about this and hope you are too.

USDS Reasonable Accommodation

USDS is committed to providing reasonable accommodations in our recruitment processes for candidates with disabilities, pregnancy, sincerely held religious beliefs or other reasons protected by applicable laws. If you need assistance or a reasonable accommodation, please reach out to us at https://tinyurl.com/USDS-RA

Job Information

【For Pay Transparency】Compensation Description (Annually)

The base salary range for this position in the selected city is $199800 - $441600 annually.

Compensation may vary outside of this range depending on a number of factors, including a candidate’s qualifications, skills, competencies and experience, and location. Base pay is one part of the Total Package that is provided to compensate and recognize employees for their work, and this role may be eligible for additional discretionary bonuses/incentives, and restricted stock units.

Benefits may vary depending on the nature of employment and the country work location. Employees have day one access to medical, dental, and vision insurance, a 401(k) savings plan with company match, paid parental leave, short-term and long-term disability coverage, life insurance, wellbeing benefits, among others.

Employees also receive 10 paid holidays per year, 10 paid sick days per year and 17 days of Paid Personal Time (prorated upon hire with increasing accruals by tenure).

The Company reserves the right to modify or change these benefits programs at any time, with or without notice.

For Los Angeles County (unincorporated) Candidates:

1. Interacting and occasionally having unsupervised contact with internal/external clients and/or colleagues;
2. Appropriately handling and managing confidential information including proprietary and trade secret information and access to information technology systems;
3. Exercising sound judgment.

Our company believes that criminal history may have a direct, adverse and negative relationship on the following job duties, potentially resulting in the withdrawal of the conditional offer of employment: