Lead Application Security Engineer

The role

You will lead application security work at Zeta Global. You will use AI-assisted threat modeling, automated security testing and risk prioritization to build security into the software development lifecycle and platform systems.

What you will do

• Use AI-assisted threat modeling to find application, platform, API, cloud, data and AI/ML security risks early in design and development.
• Review architecture, design documents, code changes, APIs and data flows for security gaps using automated tools.
• Drive AI-assisted code security reviews using SAST, DAST, SCA, secrets detection, IaC scanning and container scanning.
• Assess third-party libraries, APIs, vendor integrations and open-source dependencies for security and supply-chain risk.
• Support AI-enabled red team, blue team and incident response simulations.
• Embed AI-driven security testing and automated risk detection into CI/CD pipelines.
• Build security automation that gives developers real-time feedback during design, coding, testing and deployment.
• Monitor emerging threats, including AI-specific risks such as prompt injection, data poisoning and model abuse.
• Contribute to internal security standards, secure engineering patterns and AI-native security playbooks.
• Work with Engineering, DevOps, QA, Product and AI platform teams to build a security-first and automation-first culture.

Required qualifications

• Bachelor's degree in Computer Science, Cybersecurity or a related field, or equivalent practical experience.
• 5+ years of experience in Application Security, DevSecOps, Secure Software Development or Security Engineering.
• Strong understanding of OWASP Top 10, SANS CWE Top 25, secure design principles and application threat modeling.
• Familiarity with AI/ML security concepts such as prompt injection, data poisoning, adversarial testing and model integrity.
• Experience building or integrating AI-assisted security workflows, security bots, automated triage systems or risk scoring models.
• Experience using AI-assisted or automation-driven approaches to improve security testing, vulnerability analysis, code review or risk prioritization.
• Experience with modern application frameworks and architectures such as React, Node.js, Django, FastAPI or similar.
• Knowledge of securing APIs, microservices, authentication and authorization, such as OAuth2, OIDC, JWT and service-to-service authentication.
• Experience with AWS, GCP or Azure, and containerized environments such as Docker and Kubernetes.
• Working knowledge of security testing tools such as Semgrep, SonarQube, Burp Suite, OWASP ZAP, Trivy, Snyk or GitHub Advanced Security.
• Ability to analyze security findings, correlate risk context and give practical remediation guidance to engineering teams.
• Strong collaboration and communication skills across Engineering, Product, QA, DevOps and Security teams.

Nice to have

• Experience with policy-as-code, infrastructure-as-code security, CI/CD security controls and automated governance.
• Experience with automation frameworks and scripting for security testing, vulnerability validation and remediation workflows.
• Relevant certifications such as OSCP, GWAPT, CSSLP, cloud security certifications or AI/ML-specific security certifications.

Benefits

• Unlimited PTO
• Excellent medical, dental and vision coverage
• Employee equity
• Employee discounts, virtual wellness classes and pet insurance

Before you apply

• Zeta Global considers applicants without regard to sex, race, color, religion, age, disability, veteran status, national or ethnic origin, sexual orientation or gender identity.

About the company

Zeta Global is an AI-Powered Marketing Cloud, listed on the NYSE as ZETA, that helps marketers acquire, grow and retain customers. It was founded in 2007 and is headquartered in New York City, with offices around the world.