Senior Application Security Engineer

Triple Lift is hiring a Senior Application Security Engineer to strengthen secure software development across engineering, platform, cloud infrastructure, and security.

• Build and maintain a global security compliance program aligned to NIST CSF
  .
• Scale application security by developing automated security testing using enterprise SAST
  , DAST
  , and code-review tools.
• Promote an SDLC that supports secure application development and infrastructure deployment, including secure coding remediation activities.
• Automate security testing in CI/CD pipelines to detect vulnerabilities early, including building and maintaining the pipeline integrations.
• Administer and drive adoption of Git Hub Advanced Security (GHAS) across engineering repositories, including:
  • Code scanning
  • Secret scanning
  • Dependency review
• Participate in threat modeling and design or architecture specification reviews to identify and mitigate risks early in the SDLC.
• Coordinate stakeholders to develop and implement a vulnerability management program and support threat-hunting activities.
• Own and conduct internal penetration testing and vulnerability assessments for applications and infrastructure, and validate outcomes from third-party pentest engagements.
• Monitor and respond to application-layer threats, including API abuse
  , business logic flaws
  , and common web vulnerabilities.
• Collaborate with product and engineering teams to ensure security is built into software design and architecture.
• Improve application security posture by implementing authentication
  , authorization
  , and data protection mechanisms.
• Enhance and facilitate security incident handling activities.
• Evangelize security best practices by providing education and awareness for employees; develop and implement secure coding guidelines and run secure development training for engineers.
• Evaluate and continuously improve security program maturity by deploying and managing security tools and processes.

• 5 years minimum experience in application security, secure software development, security engineering, or a related role.
• Strong understanding of secure coding practices and ability to guide developers through remediation strategies.
• Experience with Git Hub Advanced Security (GHAS) including:
  • Code Scanning (SAST)
  • Secret Scanning
  • Dependency Review
• Proficiency with SAST
  , DAST
  , and SCA tools (examples include CodeQL
  , Burp Suite
  , OWASP ZAP
  , Snyk
  , Checkmarx
  , Veracode
  ).
• Hands‑on experience integrating security testing tools into CI/CD pipelines for automated scanning, including designing and building pipeline workflows.
• Hands‑on penetration testing and offensive security experience across web applications
  , APIs
  , or cloud infrastructure
  .
• Knowledge of common application security vulnerabilities and mitigations including OWASP Top 10 and CWE
  , with a focus on business logic flaws and API security
  .
• Ability to perform threat modeling and participate in design or architecture spec reviews to assess security risks.
• Experience conducting security code reviews across programming languages such as Python
  , Java
  , Type Script , and Go
  .
• Security fundamentals mapped to cybersecurity and compliance frameworks, especially NIST CSF (also includes PCI
  , SOC2
  , HITRUST
  , ISO 27001/2, or similar).
• Strong understanding of AWS security services and controls (including IAM
  , VPC
  , KMS
  , Guard Duty
  , Cloud Trail
  ) and experience securing cloud-native environments and workloads, including deploying security tools within them.
• Ownership mindset with the ability to work independently with minimal oversight, delivering results in a fast‑paced environment while balancing multiple priorities.
• Continually learns and adapts, valuing correctness
  , efficiency
  , and constructive feedback.

• NIST CSF
• Git Hub Advanced…