Director, App Security

A hands-on Director, Application Security Engineering is sought to strengthen the company's cybersecurity posture and partner directly with teams building software across web, mobile, data, and AI-enabled workflows. The role embeds security into delivery practices, improves how risk is prevented and remediated, and communicates clearly with both technical and non-technical stakeholders. The Director works across software engineering, platform, DevOps, architecture, QA, infrastructure, compliance, and security teams to mature secure SDLC (SSDLC) practices, expand developer-friendly guardrails, and improve application and agent security.

• Own and evolve application security practices across the SSDLC, emphasising scalable, developer-aligned, shift-left controls.
• Operate and improve SAST, SCA, secret scanning, code scanning, repository protections, and related controls across repositories and CI/CD pipelines.
• Develop secure development enablement for citizen developers, vibe coding, and AI-assisted development, including practical guidance for tooling, code assurance, identity, observability, and enterprise standards.
• Review application and code-level vulnerabilities, validate findings, reduce noise, and drive risk-based remediation plans.
• Conduct threat modeling and security design reviews for new systems, major changes, integrations, APIs, and high-risk workflows.
• Advise teams on secure coding, authentication and authorisation, session management, secrets handling, logging, encryption, dependency hygiene, and data protection.
• Improve security guardrails for build pipelines, containers, APIs, third-party components, and deployment practices across modern and legacy environments.
• Mature risk-based vulnerability management across intake, validation, prioritisation, remediation guidance, exception handling, and reporting.
• Support secure adoption of AI-assisted development and agentic systems by assessing trust boundaries, data exposure paths, prompt and tool-invocation risks, and misuse scenarios
• Use AI productively and responsibly to accelerate analysis, triage, documentation, coding support, and security review while maintaining human judgment.
• Develop pragmatic standards, playbooks, reference architectures, documentation, and office-hour support; track recurring weaknesses, recommend structural fixes, and help leadership understand where engineering investment will reduce risk most effectively.

• 5+ years of hands-on experience in application security, product security, DevSecOps, and security engineering or a closely related software security role.
• Proven experience working directly with engineering teams in fast-moving delivery environments.
• Hands-on experience configuring, tuning, and operationalising SAST, SCA, and related tooling such as SonarQube, Dependabot, GitHub, GitHub Advanced Security, or comparable platforms.
• Ability to interpret and reason about code, identify meaningful risk, and provide specific, implementable remediation guidance to engineers.
• Practical experience with SSDLC and shift-left practices, including automated code review support, threat modeling, security design review, and vulnerability management.
• Strong understanding of application and API security, including common software weaknesses, authentication and authorisation, secrets handling, dependency risk, injection, deserialization, and data protection.
• Experience integrating reliable, scalable, and minimally disruptive security controls into CI/CD pipelines and developer workflows.
• Hands-on familiarity with cloud and modern software delivery patterns, including containers, infrastructure as code, and Git-based workflows.
• Strong judgment in vulnerability triage, balancing severity, exploitability, business impact, and engineering realities.
• Ability to write clear guidance, standards, and technical documentation for technical and non-technical audiences.
• Bias toward automation, simplification, and scalable solutions over manual heroics.
• Broad DevSecOps mindset across code, pipelines, dependencies, platforms, deployment, and operations.
• Experience using AI tools responsibly to improve engineering and security outcomes.
• Comfortable moving between code review, tooling configuration, threat modeling, vulnerability management, automation, security enablement, and emerging AI security considerations.

• Experience securing AI agents, LLM-enabled applications, copilots, or agentic workflows in production or near-production environments.
• Experience with DAST, API security testing, penetration testing coordination, red-team support, or adversarial testing of application and AI systems.
• Experience with policy-as-code, infrastructure as code scanning, container/image security, software supply-chain security, SBOMs, provenance, attestation, and secrets management.
• Familiarity with cloud security across AWS and/or GCP and the application-layer implications of cloud-native architectures.
• Experience in regulated, audit-sensitive, or event-critical environments where evidence, controls, and operational rigor matter.
• Experience building metrics, dashboards, or reporting that show AppSec posture and remediation progress.
• Experience mentoring engineers and influencing secure engineering culture without direct people management responsibility.

• Hybrid role: 3 days/week in-office.
• Preference given to candidates near a TKO office, including NYC, Stamford, Orlando, Austin, or Las Vegas.

• Hiring Rate Minimum: $142,500 annually (minimum will not fall below the applicable State/local minimum salary thresholds).
• Hiring Rate Maximum: $190,000 annually.

• Robust benefits, such as health care, retirement, vacation and other paid time off, and additional offerings.
• Short- and long-term incentives, and growth and developmental opportunities.
• Locally competitive rewards packages, including base rate.

TKO also services and partners with major sports rights holders through IMG, an industry-leading global sports marketing agency, and On Location, a global leader in premium experiential hospitality.