Lead, Application Security

Overview

We are seeking an experienced Team Lead of Application Security Engineering to establish, lead, and mature our Application Security (AppSec) Program. This senior leadership role will build a comprehensive program encompassing developer awareness, secure coding practices, training initiatives, and security enablement across the software development lifecycle. As the senior security leader for our [location] office, this position serves dual responsibilities: driving application security excellence enterprise-wide while providing local leadership, mentorship, and support to all security team members in the office.

Key Responsibilities:

          Application Security Program Development & Leadership

• Design and implement a comprehensive Application Security Program from strategy through execution, including policies, standards, processes, metrics, and tools
• Establish and mature security practices across all phases of the SDLC, including threat modeling, secure design reviews, code analysis (SAST/DAST/SCA), penetration testing, and security acceptance criteria
• Drive security awareness initiatives that elevate secure development practices across engineering teams, fostering a security-first culture
• Develop and deliver training programs for developers, architects, and product teams on secure coding, threat modeling, and emerging security risks
• Create enablement frameworks that reduce security friction while improving adherence to security standards and best practices
• Build security champions programs to embed security advocates within development teams

• Define and track program metrics and KPIs to measure security posture improvements, vulnerability reduction, and program maturity

  Technical Leadership & Innovation

• Architect and implement AppSec tooling strategies, integrating security into CI/CD pipelines and developer workflows
• Evaluate and adopt emerging security technologies and methodologies, including AI-powered security tools and secure AI development practices
• Partner with engineering leadership to balance security requirements with development velocity and business objectives
• Stay current with application security trends, vulnerabilities, and attack vectors, adapting the program to accommodate the changes from these threats/risks.
• Lead, mentor, and develop a team of 5-10 Application Security Engineers and Architects
• Build team capabilities through hiring, skills development, career planning, and performance management
• Foster a collaborative culture that emphasizes continuous learning, innovation, and operational excellence

• Allocate resources effectively across program initiatives, security assessments, and incident response activities, ensuring the team meets Service Level Agreements (SLAs) and Service Level Objectives (SLOs)

  Office Leadership & Cross-Functional Collaboration

• Serve as the senior security leader for the [location] office, providing guidance, support, and mentorship to all security personnel in the office regardless of functional reporting structure
• Act as the primary point of contact for office-based employees seeking security leadership, career guidance, or organizational support
• Build and maintain strong relationships with engineering, product, DevOps, and business stakeholders
• Communicate program strategy, progress, and risk to executive leadership and the CISO
• Collaborate with peer security leaders to ensure consistency and knowledge sharing across the enterprise security program
• 15+ years of application security experience with progression into leadership roles
• 10+ years leading application security programs, including program design, implementation, and maturation
• 5+ years managing and developing security teams, with demonstrated success in team building and talent development
• Proven track record establishing security awareness, training, and enablement programs that drive measurable improvements in security posture
• Deep expertise across the full SDLC, including secure design, code review, security testing, and deployment practices

• Hands-on experience with AppSec tools and technologies (SAST, DAST, SCA, WAF, API security, secrets management, etc.)

  Technical Skills:

• Strong understanding of modern application architectures (cloud-native, microservices, APIs, containerization)
• Proficiency with common programming languages and frameworks
• Knowledge of security frameworks and standards (OWASP, NIST, BSIMM, ISO 27001)

• Experience integrating security into CI/CD and DevSecOps environments

  Leadership & Communication

• Executive presence with ability to communicate complex security concepts to technical and non-technical audiences
• Strategic thinking balanced with tactical execution capabilities
• Influence without authority skills to drive security culture change across development organizations
• Strong interpersonal skills for coaching, mentoring, and building trust with diverse stakeholders
• Bachelor’s degree in computer science, Information Security, or related field (or equivalent experience)
• Desired security certifications (CISSP, CSSLP, CEH, OSCP, or similar)
• Experience with AI/ML security, including secure development practices for AI systems, model security, prompt injection prevention, and AI-powered security tools
• Knowledge of AI security frameworks and emerging standards (OWASP LLM Top 10, NIST AI Risk Management Framework)
• Experience in highly regulated industries (financial services, healthcare, government) with compliance requirements
• Master's degree in relevant field
• Experience with security metrics and reporting to board-level audiences

• Previous experience in multi-site or distributed team leadership

  Leadership Expectations

• This role requires a leader who can:
• Inspire and empower teams to deliver security excellence while maintaining development agility
• Navigate ambiguity in a fast-paced environment with competing priorities
• Build consensus across diverse stakeholder groups with differing objectives
• Demonstrate servant leadership by supporting team growth and removing barriers to success
• Model security-first behaviors that set the tone for the broader organization
• Provide hands-on guidance to office-based security staff on professional development, escalations, and day-to-day challenges

#LI-P1