> Markdown version of [/jobs/ext/1405166-sr-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/1405166-sr-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Sr Application Security Engineer - **Company:** The Trade Desk - **Location:** San Francisco, CA, United States - **Experience:** Expert - **Salary:** $113,500.0 - $208,100.0 - **Contract:** Permanent contract - **Skills:** Kubernetes Security, Java (Programming Language), JavaScript (Programming Language), Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Software System Penetration Testing, Microsoft Azure, C Sharp (Programming Language), Software as a Service, Cloud Computing Security, Code Review, Cyber Security, Continuous Integration, Software Design Patterns, Github, Python (Programming Language), Key Management, Octopus Deploy, Performance Tuning, Software Engineering, Software Vulnerability Management, Istio, Large Language Models, Software Security, Gitlab, GWAPT, Kubernetes, Production Code, Enterprise Integration, Machine Learning Operations, Docker, Jenkins, Static Application Security Testing, Golang, Dynamic Application Security Testing - **Published:** July 23, 2026 - **Apply:** https://diversityjobs.com/main/sendform/8/8/28176/1/17677881?backUrl=%2Fcareer%2F17677881%2FSr-Application-Security-Engineer-New-York-Bellevue ## About the Role * BS degree or equivalent years of experience in related field * 6-8+ years in application security with a track record of building tooling and automation, not just operating it. * Active software development experience - you write clean, production-ready code in at least one of: C#, Java, Python, Go, or JavaScript. Candidates who currently or recently ship code are meaningfully better positioned for this role. * Hands-on experience with SAST, DAST, SCA, and secrets management tooling, including configuration, tuning, and CI/CD integration (GitHub Actions, GitLab, Jenkins, ArgoCD, or similar). * Practical threat modeling experience (STRIDE, PASTA, or equivalent) - producing engineering-useful outputs, not just risk documentation. * Experience with vulnerability management workflows: aggregation, triage, risk-based prioritization, and driving remediation at scale. * Working knowledge of Kubernetes and container security (Docker, Helm, Istio) and cloud security fundamentals across at least one major platform (AWS, GCP, or Azure). * Experience in AI/ML security - securing AI pipelines, assessing LLM integrations, understanding GenAI attack surfaces, or building AI-assisted security tooling. This is a meaningful differentiator. * Strong written and verbal communication skills - able to translate technical risk into terms that resonate with engineering teams, product leadership, and the broader customer-first mindset that drives decisions at The Trade Desk. * Certifications such as OSWE, GWAPT, CSSLP, OSCP, or cloud security certifications (AWS, GCP, or Azure) are a plus. * Experience in ad tech, large-scale SaaS, or other high-throughput consumer or enterprise platforms is a plus. #LI-TP1 ## Description We are looking for a Senior Application Security Engineer to join our Cybersecurity Department. This person will complement and extend the application security capabilities we have built - with significant opportunity to make an immediate, sizable impact. You will own tooling, lead threat modeling, and harden the application security program across a platform used daily by the world's largest brands. This is not a steady-state role: there is meaningful work to do, and the right person will see it and run toward it. The right candidate brings deep application security expertise, strong software development instincts, and a genuine bias to action. You are someone who builds things - not just findings documents. You think about security from the perspective of the engineers you partner with and the customers whose trust is at stake, and you communicate in ways that make both groups more effective. Beyond the technical experience, we are looking for someone with the qualities that make a security engineer effective in a collaborative, fast-moving engineering culture. You are curious about how systems work and how they break. You pair that curiosity with ownership and follow-through. You communicate clearly, give and receive feedback well, and approach the engineers you work with as partners - not gatekeepers. Security is a team sport, and you bring that mindset every day. What you'll do: * Extend and own scalable AppSec tooling across four core areas: SAST/DAST pipeline integration, vulnerability management, threat modeling frameworks, and security posture- building on existing foundations and closing meaningful gaps. * Validate findings end-to-end: triage and reproduce scanner output to separate signal from noise, then contextualize risk so engineering teams understand exactly what to fix, why it matters, and what the customer impact would be if exploited. * Review and assess new features, APIs, and architectural changes; conduct security-focused code reviews (C#, Java, JavaScript, or similar) and application-layer penetration tests. * Write production-quality security automation and tooling - this role ships code alongside security guidance. * Assess and help secure AI/ML systems - including inference APIs, LLM integrations, and GenAI attack surfaces such as prompt injection and model exfiltration - and build AI-augmented tooling to scale the team's output. * Drive security culture through direct engineering partnership: advising on secure-by-design patterns early in the development process, raising the security floor across hundreds of engineers, and keeping customer trust at the center of every recommendation. * Participate in and drive security governance-first frameworks to include developing and publishing standards, guidelines, procedures, secure baselines, and policies. ## Related Videos - [Rate-limiting using eBPF and Istio: How to protect your SaaS customers from themselves](https://www.wearedevelopers.com/videos/100220-rate-limiting-using-ebpf-and-istio-how-to-protect-your-saas-customers-from-themselves) - [Go with the Flow: Stop the Leaks Before Your Memory's a Waterfall!](https://www.wearedevelopers.com/videos/100073-go-with-the-flow-stop-the-leaks-before-your-memory-s-a-waterfall) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Get started with securing your cloud-native Java microservices applications](https://www.wearedevelopers.com/videos/123-get-started-with-securing-your-cloud-native-java-microservices-applications) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [Scoring 2000 Products per Request: Performance Pitfalls in Golang](https://www.wearedevelopers.com/videos/2073-scoring-2000-products-per-request-performance-pitfalls-in-golang) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers) - [Dev Digest 121 - AI goes offline](https://www.wearedevelopers.com/magazine/456-dev-digest-121-ai-goes-offline) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers)