Lead Application Security Engineer
Zeta Global3 months ago
Base Salary
$140k - $180k/yr
Responsibilities
- Use AI-assisted threat modeling and automated security reviews to identify application, platform, API, cloud, data, and AI/ML security risks.
- Drive AI-assisted code security reviews using SAST, DAST, SCA, secrets detection, IaC scanning, container scanning, and contextual risk analysis.
- Assess third-party libraries, APIs, vendor integrations, and open-source dependencies for security, compliance, and supply-chain risks.
- Support AI-enabled red-team, blue-team, and incident-response simulations.
- Embed AI-driven security testing and automated risk detection into CI/CD pipelines and provide real-time developer feedback.
- Design scalable guardrails, reusable security controls, policy-as-code capabilities, and intelligent security checkpoints.
- Monitor application, cloud, API, AI/ML, and data security threats, including prompt injection, data poisoning, model abuse, model leakage, insecure tool use, and sensitive data exposure.
- Use telemetry, automated signals, and risk scoring to support investigations, post-incident analysis, and continuous improvement.
- Promote secure coding and design through playbooks, automated recommendations, documentation, and security self-service capabilities.
- Measure control effectiveness, remediation trends, developer adoption, and overall security maturity.
Requirements
- Bachelor’s degree in Computer Science, Cybersecurity, or a related field, or equivalent practical experience.
- At least five years of experience in Application Security, DevSecOps, Secure Software Development, or Security Engineering.
- Strong knowledge of OWASP Top 10, SANS CWE Top 25, secure design principles, and application threat modeling.
- Familiarity with AI/ML security risks including prompt injection, data poisoning, adversarial testing, model integrity, model abuse, and AI supply-chain risks.
- Experience building or integrating AI-assisted security workflows, security bots, automated triage systems, or risk-scoring models.
- Experience using AI-assisted or automation-driven approaches for security testing, vulnerability analysis, code review, or risk prioritization.
- Experience with modern application frameworks such as React, Node.js, Django, FastAPI, or similar technologies.
- Knowledge of API, microservice, authentication, and authorization security, including OAuth2, OIDC, JWT, and service-to-service authentication.
- Experience with AWS, GCP, or Azure and containerized environments such as Docker and Kubernetes.
- Working knowledge of Semgrep, SonarQube, Burp Suite, OWASP ZAP, Trivy, Snyk, GitHub Advanced Security, or similar tools.
- Ability to analyze security findings, correlate risk context, and drive practical remediation guidance.
- Strong collaboration and communication skills across Engineering, Product, QA, DevOps, and Security teams.
- Preferred experience with policy-as-code, infrastructure-as-code security, CI/CD security controls, automated governance, and security automation frameworks.
- Relevant certifications such as OSCP, GWAPT, CSSLP, cloud security certifications, or AI/ML-specific security certifications are preferred.
Benefits
- Unlimited PTO
- Medical, dental, and vision coverage
- Employee equity
- Employee discounts
- Virtual wellness classes
- Pet insurance
Tech Stack
About Zeta Global
Zeta Global builds an AI-powered marketing cloud that unifies customer data, analytics, and omnichannel activation for enterprise brands and agencies. Its Zeta Marketing Platform combines martech and adtech—spanning CRM, email, display, and social—to acquire, grow, and retain customers on a subscription and media-buying model. Founded in 2007 and headquartered in New York City, Zeta is a public company trading on the NYSE under the ticker ZETA.