Senior Application Security Engineer
TripleLift2 months ago
Toronto, CanadaSenior
Responsibilities
- Build and maintain a global security compliance program based on NIST CSF.
- Develop automated security testing with enterprise SAST, DAST, and code-review tools.
- Promote secure application development and coordinate secure coding remediation.
- Automate security testing in CI/CD pipelines and maintain the associated integrations.
- Administer and drive adoption of GitHub Advanced Security across engineering repositories.
- Conduct threat modeling and architecture reviews to identify and mitigate security risks early.
- Develop and implement vulnerability management and threat-hunting programs.
- Own internal penetration testing and vulnerability assessments and validate third-party penetration testing findings.
- Monitor and respond to application-layer threats, including API abuse, business logic flaws, and common web vulnerabilities.
- Partner with engineering and product teams on authentication, authorization, data protection, and secure software design.
- Support security incident handling and deliver secure development training and security awareness education.
- Evaluate and improve security program maturity through security tools and processes.
Requirements
- At least five years of experience in application security, secure software development, security engineering, or a similar role.
- Strong understanding of secure coding practices and the ability to guide developers through remediation.
- Experience with GitHub Advanced Security, including code scanning, secret scanning, and dependency review.
- Proficiency with SAST, DAST, and SCA tools such as CodeQL, Burp Suite, OWASP ZAP, Snyk, Checkmarx, and Veracode.
- Hands-on experience integrating automated security scanning into CI/CD pipelines and building pipeline workflows.
- Hands-on penetration testing and offensive security experience across web applications, APIs, or cloud infrastructure.
- Knowledge of OWASP Top 10, CWE, business logic flaws, API security, and related mitigations.
- Experience with threat modeling, architecture reviews, and security code reviews across Python, Java, TypeScript, or Go.
- Understanding of NIST CSF and other cybersecurity or compliance frameworks such as PCI, SOC 2, HITRUST, and ISO 27001/2.
- Strong understanding of AWS security services and controls, including IAM, VPC, KMS, GuardDuty, and CloudTrail.
- Preferred experience in ad-tech, programmatic advertising, or another high-scale real-time environment.
- Preferred familiarity with AI/LLM-based tools such as Claude for threat intelligence, alert triage, or security automation.
- A cybersecurity certification such as OSCP, GWAPT, CISSP, or CISA is preferred.
About TripleLift
TripleLift is a creative supply-side platform that supports programmatic advertising across online video, connected TV, display, and native formats for publishers, advertisers, and agencies. It provides a marketplace and ad-tech tools to monetize inventory and execute media buying, earning transaction-based fees. Founded in 2012 and headquartered in New York, the company is owned by Vista Equity Partners and handles over 1 trillion ad transactions each month.