Director, App Security IMG

Skills / Requirements

• AI Tools
• API Security
• Application security
• CI/CD
• Cloud Security
• Containers
• DevSecOps
• GitHub
• IAC
• Product Security
• SAST
• SCA
• Security Documentation
• Security Engineering
• Shift-left Practices
• SonarQube
• SSDLC
• Threat Modeling
• Vibe Coding
• Vulnerability Management

Why Apply

This role is ideal for those using AI tools to streamline security processes. You'll work with AI-assisted development and agentic systems, assessing risks and enhancing security with AI-driven insights and automation.

What You'll Be Doing

Day-to-day, you'll improve application security practices, conduct threat modeling, and guide teams in secure coding. You'll also manage security tooling and develop standards to integrate security seamlessly into development workflows.

Pay and Career Growth

The role offers a salary range of $142,500 to $190,000 annually, reflecting the senior-level responsibilities. TKO provides competitive rewards packages, including incentives and robust benefits, supporting career growth and development.

Benefits and Perks

• developmental opportunities
• Growth Opportunities
• health care
• long-term incentives
• Paid Time Off
• Retirement
• short-term incentives
• Vacation

Is This Role Right for You?

Original Job Description

Who We Are: TKO Group Holdings, Inc. (NYSE: TKO) is a premium sports and entertainment company. TKO owns iconic properties including UFC, the world’s premier mixed martial arts organization; WWE, the global leader in sports entertainment; and PBR, the world’s premier bull riding organization. Together, these properties reach 1 billion households across 210 countries and territories and organize more than 500 live events year-round, attracting more than three million fans. TKO also services and partners with major sports rights holders through IMG, an industry-leading global sports marketing agency; and On Location, a global leader in premium experiential hospitality. Overview We are looking for a hands-on Director, Application Security Engineering to strengthen our cybersecurity posture and partner directly with teams building software across web, mobile, data, and AI-enabled workflows. This role will embed security into delivery practices, improve how we prevent and remediate risk, and communicate clearly with both technical and non-technical stakeholders. This Director will work across software engineering, platform, DevOps, architecture, QA, infrastructure, compliance, and security teams to mature secure SDLC (i.e., SSDLC) practices, expand developer-friendly guardrails, and improve application and agent security. They should be comfortable moving between code review, tooling configuration, threat modeling, vulnerability management, automation, security enablement, and emerging AI security considerations. This is a hybrid role (3 days/week in-office). Preference given to candidates near a TKO office, including NYC, Stamford, Orlando, Austin, or Las Vegas. The Role and What You’ll Do The Director, Application Security Engineering will: Own and evolve application security practices across the SSDLC, emphasizing scalable, developer-aligned, shift-left controls Operate and improve SAST, SCA, secret scanning, code scanning, repository protections, and related controls across repositories and CI/CD pipelines Develop secure development enablement for citizen developers, vibe coding, and AI-assisted development, including practical guidance for tooling, code assurance, identity, observability, and enterprise standards Review application and code-level vulnerabilities, validate findings, reduce noise, and drive risk-based remediation plans Conduct threat modeling and security design reviews for new systems, major changes, integrations, APIs, and high-risk workflows Advise teams on secure coding, authentication and authorization, session management, secrets handling, logging, encryption, dependency hygiene, and data protection Improve security guardrails for build pipelines, containers, APIs, third-party components, and deployment practices across modern and legacy environments Mature risk-based vulnerability management across intake, validation, prioritization, remediation guidance, exception handling, and reporting Support secure adoption of AI-assisted development and agentic systems by assessing trust boundaries, data exposure paths, prompt and tool-invocation risks, and misuse scenarios Develop pragmatic standards, playbooks, reference architectures, documentation, and office-hour support that improve consistency without slowing teams down unnecessarily Track recurring weaknesses, recommend structural fixes, and help leadership understand where engineering investment will reduce risk most effectively Use AI productively and responsibly to accelerate analysis, triage, documentation, coding support, and security review while maintaining strong human judgment Required Skills and Experience 5+ years of hands-on experience in application security, product security, DevSecOps, and security engineering or a closely related software security role Proven experience working directly with engineering teams in fast-moving delivery environments Hands-on experience configuring, tuning, and operationalizing SAST, SCA, and related tooling such as SonarQube, Dependabot, GitHub, GitHub Advanced Security, or comparable platforms Ability to interpret and reason about code, identify meaningful risk, and provide specific, implementable remediation guidance to engineers Practical experience with SSDLC and shift-left practices, including automated code review support, threat modeling, security design review, and vulnerability management Strong understanding of application and API security, including common software weaknesses, authN/authZ, secrets handling, dependency risk, injection, deserialization, and data protection Experience integrating reliable, scalable, and minimally disruptive security controls into CI/CD pipelines and developer workflows Hands-on familiarity with cloud and modern software delivery patterns, including containers, IaC, and Git-based workflows Strong judgment in vulnerability triage, balancing severity, exploitability, business impact, and engineering realities Ability to write clear guidance, standards, and technical documentation for technical and non-technical audiences Bias toward automation, simplification, and scalable solutions over manual heroics Broad DevSecOps mindset across code, pipelines, dependencies, platforms, deployment, and operations Experience using AI tools responsibly to improve engineering and security outcomes Preferred Skills and Experience Experience securing AI agents, LLM-enabled applications, copilots, or agentic workflows in production or near-production environments Experience with DAST, API security testing, penetration testing coordination, red-team support, or adversarial testing of application and AI systems Experience with policy-as-code, IaC scanning, container/image security, software supply-chain security, SBOMs, provenance, attestation, and secrets management Familiarity with cloud security across AWS and/or GCP and the application-layer implications of cloud-native architectures Experience in regulated, audit-sensitive, or event-critical environments where evidence, controls, and operational rigor matter Experience building metrics, dashboards, or reporting that show AppSec posture and remediation progress Experience mentoring engineers and influencing secure engineering culture without direct people management responsibility What Good Looks Like in This Role Engineering teams get faster, clearer, and more actionable security guidance as well as assistance with implementation and mechanics for a “teach a person to fish” approach Security tooling produces more trustworthy signals and leads to better adoption, not just more alerts Teams catch and remediate issues earlier in design and development rather than late in release cycles Application and agent-security risks are surfaced in practical terms with concrete mitigation paths Standards, playbooks, and tooling make secure delivery easier and more consistent Security becomes more embedded in day-to-day engineering execution and technical operations, and less dependent on last-minute security scrambles and efforts, Per local requirements and in the interest of transparency, the hourly rate shown below reflects the prevalent current hiring range for this position. Hiring pay rates are based on a number of factors, including location and may vary depending on job-related qualifications, knowledge, skills and experience. The company strives to provide locally competitive rewards packages, which include base rate along with, as applicable, short- and long-term incentives, growth and developmental opportunities, and robust benefits, such as health care, retirement, vacation and other paid time off, and additional offerings. Hiring Rate Minimum: $142,500 annually(minimum will not fall below the applicable State/local minimum salary thresholds) Hiring Rate Maximum: $190,000 annually TKO is an Equal Opportunity Employer and complies with all applicable federal, state, and local laws regarding non-discrimination in employment. TKO makes employment decisions based on merit and qualifications, without considering an employee’s or applicant’s race, color, religion, sex, sexual orientation, gender identity or expression, national origin, age, disability, marital status, veteran status, or any other basis prohibited under federal, state or local laws governing non-discrimination in employment in every location in which the Company has facilities. TKO also provides reasonable accommodations for qualified individuals with disabilities in accordance with the Americans with Disabilities Act (ADA) and applicable state or local laws. For information about Privacy and Information Security for TKO employment candidates, please review our Privacy Policy. For information regarding Terms of Use for this and other TKO websites, please review our Terms of Use. TKO Group Holdings, Inc. (NYSE: TKO) is a premium sports and entertainment company. TKO owns iconic properties including UFC, the world’s premier mixed martial arts organization; WWE, the global leader in sports entertainment; and PBR, the world’s premier bull riding organization. Together, these properties reach 1 billion households across 210 countries and territories and organize more than 500 live events year-round, attracting more than three million fans. TKO also services and partners with major sports rights holders through IMG, an industry-leading global sports marketing agency; and On Location, a global leader in premium experiential hospitality. About WWE WWE® is an integrated media organization and the recognized global leader in sports entertainment. The company consists of a portfolio of businesses that create and deliver original content 52 weeks a year to a global audience. WWE is committed to family-friendly entertainment on its television programming, premium live events, digital media, and publishing platforms. WWE’s TV-PG programming can be seen in more than 1 billion households worldwide in more than 20 languages through world-class distribution partners including NBCUniversal, The CW and Netflix. In the United States, NBCUniversal’s streaming service, Peacock, is the exclusive home to all premium live events, a variety of original programming and a massive video-on-demand library. Netflix is the exclusive home for WWE programming around the world, other than select international markets. WWE is part of TKO Group Holdings (NYSE: TKO). Additional information on WWE can be found at wwe.com and corporate.wwe.com. About UFC UFC® is the world’s premier mixed martial arts organization (MMA), with more than 700 million fans and approximately 290 million social media followers. The organization produces more than 40 live events annually in some of the most prestigious arenas around the world while broadcasting to over 975 million households across more than 170 countries. UFC’s athlete roster features the world’s best MMA athletes representing more than 80 countries. The organization’s digital offerings include UFC FIGHT PASS®, one of the world’s leading streaming services for combat sports. UFC is part of TKO Group Holdings (NYSE: TKO) and is headquartered in Las Vegas, Nevada. For more information, visit UFC.com and follow UFC at Facebook.com/UFC and @UFC on X, Snapchat, Instagram, and TikTok: @UFC. About IMG IMG is a leading global sports marketing agency, specializing in media rights management and sales, multi-channel content production and distribution, brand partnerships, strategic consulting, digital services, and events management. It powers growth of revenues, fanbases and IP for more than 200 federations, associations, events, and teams, including the National Football League, English Premier League, International Olympic Committee, National Hockey League, Major League Soccer, ATP and WTA Tours, the AELTC (Wimbledon), Euroleague Basketball, CONMEBOL, DP World Tour, and The R&A, as well as UFC, WWE, and PBR. IMG is a subsidiary of TKO Group Holdings, Inc. (NYSE: TKO), a premium sports and entertainment company. About PBR PBR is the world’s premier bull riding organization. More than 1,000 bull riders compete in more than 200 events annually across the televised PBR Unleash The Beast tour (UTB), which features the top bull riders in the world; the PBR Pendleton Whisky Velocity Tour (PWVT); the PBR Touring Pro Division (TPD); and the PBR’s international circuits in Australia, Brazil, and Canada. In 2022, PBR launched the nationally televised PBR Teams league—eight teams of the world’s best bull riders competing for a new championship expanding to 10 teams in 2024—as well as the PBR Challenger Series with more than 60 annual events nationwide. The organization’s digital assets include PBR RidePass on Pluto TV, which is home to Western sports. PBR is a subsidiary of TKO Group Holdings, Inc. (NYSE: TKO), a premium sports and entertainment company. For more information, visit PBR.com, or follow on Facebook at Facebook.com/PBR, X at X.com/PBR, and YouTube at YouTube.com/PBR. About On Location On Location is a global leader in premium experiential hospitality, offering ticketing, curated guest experiences, live event production and travel management across sports, entertainment, fashion and culture. On Location provides unrivaled access for corporate clients and fans looking for official, immersive experiences at marquee events, including the Olympic and Paralympic Games, FIFA World Cup 2026, Super Bowl, NCAA Final Four, and more. An official partner and/or service provider to over 150 iconic rights holders, such as the IOC (the Milano Cortina 2026 and Los Angeles 2028 Olympic Games), FIFA, NFL, NCAA, UFC, WWE, and PGA of America, the company also owns and operates a number of its own unique experiences. On Location is a subsidiary of TKO Group Holdings, Inc. (NYSE: TKO), a premium sports and entertainment company. About Zuffa Boxing Zuffa Boxing is a joint venture between TKO Group Holdings, Inc. (“TKO”) (NYSE: TKO) and Sela, the entertainment conglomerate. TKO serves as managing partner, providing day-to-day operational expertise, management, and oversight of the promotion, with executive leadership anchored by UFC President and CEO Dana White and WWE President and TKO Board Member Nick Khan. The promotion aims to reimagine the sport of boxing by evolving the current model to restore the sport’s rightful place in the forefront of the global sports ecosystem. For more information, follow @Zuffa_Boxing on X; and @ZuffaBoxing on Snapchat, Instagram, Threads, and TikTok.