Director, App Security

Who We Are: TKO Group Holdings, Inc. (NYSE: TKO) is a premium sports and entertainment company. TKO owns iconic properties including UFC, the world’s premier mixed martial arts organization; WWE, the global leader in sports entertainment; and PBR, the world’s premier bull riding organization. Together, these properties reach 1 billion households across 210 countries and territories and organize more than 500 live events year-round, attracting more than three million fans. TKO also services and partners with major sports rights holders through IMG, an industry-leading global sports marketing agency; and On Location, a global leader in premium experiential hospitality. OverviewWe are looking for a hands-on Director, Application Security Engineering to strengthen our cybersecurity posture and partner directly with teams building software across web, mobile, data, and AI-enabled workflows. This role will embed security into delivery practices, improve how we prevent and remediate risk, and communicate clearly with both technical and non-technical stakeholders. This Director will work across software engineering, platform, DevOps, architecture, QA, infrastructure, compliance, and security teams to mature secure SDLC (i.e., SSDLC) practices, expand developer-friendly guardrails, and improve application and agent security. They should be comfortable moving between code review, tooling configuration, threat modeling, vulnerability management, automation, security enablement, and emerging AI security considerations. This is a hybrid role (3 days/week in-office). Preference given to candidates near a TKO office, including NYC, Stamford, Orlando, Austin, or Las Vegas. The Role and What You’ll DoThe Director, Application Security Engineering will: Own and evolve application security practices across the SSDLC, emphasizing scalable, developer-aligned, shift-left controlsOperate and improve SAST, SCA, secret scanning, code scanning, repository protections, and related controls across repositories and CI/CD pipelinesDevelop secure development enablement for citizen developers, vibe coding, and AI-assisted development, including practical guidance for tooling, code assurance, identity, observability, and enterprise standardsReview application and code-level vulnerabilities, validate findings, reduce noise, and drive risk-based remediation plansConduct threat modeling and security design reviews for new systems, major changes, integrations, APIs, and high-risk workflowsAdvise teams on secure coding, authentication and authorization, session management, secrets handling, logging, encryption, dependency hygiene, and data protectionImprove security guardrails for build pipelines, containers, APIs, third-party components, and deployment practices across modern and legacy environmentsMature risk-based vulnerability management across intake, validation, prioritization, remediation guidance, exception handling, and reportingSupport secure adoption of AI-assisted development and agentic systems by assessing trust boundaries, data exposure paths, prompt and tool-invocation risks, and misuse scenariosDevelop pragmatic standards, playbooks, reference architectures, documentation, and office-hour support that improve consistency without slowing teams down unnecessarilyTrack recurring weaknesses, recommend structural fixes, and help leadership understand where engineering investment will reduce risk most effectivelyUse AI productively and responsibly to accelerate analysis, triage, documentation, coding support, and security review while maintaining strong human judgment Required Skills and Experience5+ years of hands-on experience in application security, product security, DevSecOps, and security engineering or a closely related software security roleProven experience working directly with engineering teams in fast-moving delivery environmentsHands-on experience configuring, tuning, and operationalizing SAST, SCA, and related tooling such as SonarQube, Dependabot, GitHub, GitHub Advanced Security, or comparable platformsAbility to interpret and reason about code, identify meaningful risk, and provide specific, implementable remediation guidance to engineersPractical experience with SSDLC and shift-left practices, including automated code review support, threat modeling, security design review, and vulnerability managementStrong understanding of application and API security, including common software weaknesses, authN/authZ, secrets handling, dependency risk, injection, deserialization, and data protectionExperience integrating reliable, scalable, and minimally disruptive security controls into CI/CD pipelines and developer workflowsHands-on familiarity with cloud and modern software delivery patterns, including containers, IaC, and Git-based workflowsStrong judgment in vulnerability triage, balancing severity, exploitability, business impact, and engineering realitiesAbility to write clear guidance, standards, and technical documentation for technical and non-technical audiencesBias toward automation, simplification, and scalable solutions over manual heroicsBroad DevSecOps mindset across code, pipelines, dependencies, platforms, deployment, and operationsExperience using AI tools responsibly to improve engineering and security outcomes Preferred Skills and ExperienceExperience securing AI agents, LLM-enabled applications, copilots, or agentic workflows in production or near-production environmentsExperience with DAST, API security testing, penetration testing coordination, red-team support, or adversarial testing of application and AI systemsExperience with policy-as-code, IaC scanning, container/image security, software supply-chain security, SBOMs, provenance, attestation, and secrets managementFamiliarity with cloud security across AWS and/or GCP and the application-layer implications of cloud-native architecturesExperience in regulated, audit-sensitive, or event-critical environments where evidence, controls, and operational rigor matterExperience building metrics, dashboards, or reporting that show AppSec posture and remediation progressExperience mentoring engineers and influencing secure engineering culture without direct people management responsibility What Good Looks Like in This RoleEngineering teams get faster, clearer, and more actionable security guidance as well as assistance with implementation and mechanics for a "teach a person to fish" approachSecurity tooling produces more trustworthy signals and leads to better adoption, not just more alertsTeams catch and remediate issues earlier in design and development rather than late in release cyclesApplication and agent-security risks are surfaced in practical terms with concrete mitigation pathsStandards, playbooks, and tooling make secure delivery easier and more consistentSecurity becomes more embedded in day-to-day engineering execution and technical operations, and less dependent on last-minute security scrambles and efforts, Per local requirements and in the interest of transparency, the hourly rate shown below reflects the prevalent current hiring range for this position. Hiring pay rates are based on a number of factors, including location and may vary depending on job-related qualifications, knowledge, skills and experience. The company strives to provide locally competitive rewards packages, which include base rate along with, as applicable, short- and long-term incentives, growth and developmental opportunities, and robust benefits, such as health care, retirement, vacation and other paid time off, and additional offerings. Hiring Rate Minimum: $142,500 annually(minimum will not fall below the applicable State/local minimum salary thresholds) Hiring Rate Maximum: $190,000 annually TKO is an Equal Opportunity Employer and complies with all applicable federal, state, and local laws regarding non-discrimination in employment. TKO makes employment decisions based on merit and qualifications, without considering an employee’s or applicant’s race, color, religion, sex, sexual orientation, gender identity or expression, national origin, age, disability, marital status, veteran status, or any other basis prohibited under federal, state or local laws governing non-discrimination in employment in every location in which the Company has facilities. TKO also provides reasonable accommodations for qualified individuals with disabilities in accordance with the Americans with Disabilities Act (ADA) and applicable state or local laws. For information about Privacy and Information Security for TKO employment candidates, please review our Privacy Policy. For information regarding Terms of Use for this and other TKO websites, please review our Terms of Use.