Lead Application Security Engineer
Zeta Global3 months ago
Base Salary
$140k - $180k/yr
Responsibilities
- Use AI-assisted threat modeling and automated security reviews to identify application, platform, API, cloud, data, and AI/ML security risks.
- Drive SAST, DAST, SCA, secrets detection, infrastructure-as-code scanning, container scanning, and contextual risk analysis.
- Embed AI-driven security testing and automated risk detection into CI/CD pipelines and provide real-time developer feedback.
- Design scalable guardrails, reusable security controls, policy-as-code capabilities, and security self-service workflows.
- Monitor emerging application, cloud, API, AI/ML, and data security threats, including prompt injection, data poisoning, model abuse, model leakage, insecure tool use, and sensitive data exposure.
- Develop proactive defense mechanisms and use telemetry, automated signals, and risk scoring to support investigations and post-incident analysis.
- Promote secure coding and secure design through reusable playbooks, automated recommendations, documentation, and security standards.
- Collaborate with Engineering, DevOps, QA, Product, and AI platform teams to measure control effectiveness, remediation trends, developer adoption, and security maturity.
Requirements
- Bachelor’s degree in Computer Science, Cybersecurity, or a related field, or equivalent practical experience.
- At least five years of experience in Application Security, DevSecOps, Secure Software Development, or Security Engineering.
- Strong understanding of OWASP Top 10, SANS CWE Top 25, secure design principles, and application threat modeling.
- Familiarity with AI/ML security concepts including prompt injection, data poisoning, adversarial testing, model integrity, model abuse, and AI supply-chain risks.
- Experience building or integrating AI-assisted security workflows, security bots, automated triage systems, or risk-scoring models.
- Experience using AI-assisted or automation-driven approaches for security testing, vulnerability analysis, code review, or risk prioritization.
- Experience with modern application frameworks and architectures such as React, Node.js, Django, or FastAPI.
- Knowledge of securing APIs, microservices, authentication, and authorization mechanisms including OAuth2, OIDC, JWT, and service-to-service authentication.
- Experience with AWS, GCP, or Azure and containerized environments such as Docker and Kubernetes.
- Working knowledge of Semgrep, SonarQube, Burp Suite, OWASP ZAP, Trivy, Snyk, GitHub Advanced Security, or similar tools.
- Ability to analyze security findings, correlate risk context, and provide practical remediation guidance.
- Experience with policy-as-code, infrastructure-as-code security, CI/CD security controls, and automated governance is preferred.
- Experience with automation frameworks and scripting for security testing, vulnerability validation, and remediation workflows is preferred.
- Relevant certifications such as OSCP, GWAPT, CSSLP, cloud security certifications, or AI/ML-specific security certifications are preferred.
Benefits
- Unlimited PTO
- Medical, dental, and vision coverage
- Employee equity
- Employee discounts, virtual wellness classes, and pet insurance
Tech Stack
Categories
About Zeta Global
Zeta Global builds an AI-powered marketing cloud that unifies customer data, analytics, and omnichannel activation for enterprise brands and agencies. Its Zeta Marketing Platform combines martech and adtech—spanning CRM, email, display, and social—to acquire, grow, and retain customers on a subscription and media-buying model. Founded in 2007 and headquartered in New York City, Zeta is a public company trading on the NYSE under the ticker ZETA.