Staff Application Security Engineer

Zeta Global is the AI-Powered Marketing Cloud that utilizes advanced artificial intelligence to enhance marketing efficiency. They are seeking a Staff Application Security Engineer to lead security initiatives across the development lifecycle, ensuring secure practices are applied consistently while safeguarding high-performance systems.

Responsibilities:

• Lead threat modeling and security architecture reviews for distributed, event-driven systems
• Integrate security code reviews, SAST/DAST, Software Composition Analysis (SCA), and container scanning into CI/CD and AI/ML pipelines
• Coordinate and lead incident simulations specific to AI systems; oversee red/blue team exercises to validate defensive posture
• Conduct security reviews of third-party vendors and tools to ensure alignment with enterprise security standards
• Collaborate with engineers and product teams to build secure features without impeding innovation
• Establish and lead security checkpoints across the software development lifecycle
• Review system designs, architecture, and data flow diagrams to identify and mitigate risks early
• Collaborate with key stakeholders to drive informed Go/No-Go security decisions for all major production deployments
• Stay on the forefront of security innovations, including OWASP, cloud-native, and API security practices
• Monitor modern threat vectors like LLM jailbreaks, prompt injection, and data poisoning
• Recommend and implement forward-looking controls to safeguard AI models and data platforms
• Evangelize secure coding and AI security through training, brown bag sessions, and workshops
• Develop and roll out internal security policies, standards, and best practices
• Raise awareness of security threats through documentation and hands-on engagement
• Foster a security-first culture across engineering, product, and data teams

Requirements:

• Bachelor's degree in Computer Science, Cybersecurity, or a related field, or equivalent experience
• 5+ years of experience in Application Security, DevSecOps, or secure software development
• In-depth understanding of OWASP Top 10, SANS CWE Top 25, MITRE ATT&CK for ML, and adversarial threat modeling
• Experience securing modern frameworks and architectures (e.g., React, Node.js, Django, FastAPI)
• Familiarity with AI/ML attack vectors including model inversion, adversarial examples, and training pipeline integrity
• Strong foundation in OAuth2, OpenID Connect, JWT, and securing APIs and microservices
• Experience with cloud-native security (e.g., AWS, GCP, Azure) and container technologies (e.g., Docker, Kubernetes)
• Strong communication and stakeholder management skills
• Hands-on with tools like Semgrep, Veracode, Checkmarx, SonarQube, Burp Suite, Zap, Trivy, Brakeman, or LangSec
• Certifications such as OSCP, CSSLP, GWAPT, or ML-specific certs (e.g., MITRE ATT&CK Defender for ML)