Lead, Application Security
Core
Lead the enterprise application security program, shaping capabilities for cloud-native and DevOps environments to drive secure-by-design outcomes and risk reduction.
Role type
Senior IC application security lead (attack surface management)
Builds
Enterprise application security program, automated security controls in CI/CD pipelines, and secure-by-design engineering practices
Domain
Financial services, cloud security, DevSecOps
Required skills
Application security program leadership, vulnerability management, DevSecOps expertise, SAST/SCA/DAST/ASPM tooling, software composition analysis (SCA), SBOMs, supply chain risk management, security frameworks (OWASP, NIST, PCI DSS), policy-as-code, CI/CD integration, exploit validation, technical mentorship
Preferred skills
Python/PowerShell/Bash scripting, web application penetration testing, threat actor knowledge, Agentic AI in security, advanced security certifications (OSCP, GPEN, etc.), cloud certifications (AWS, Azure, GCP)
Technologies
SAST, SCA, DAST, ASPM, CI/CD pipelines, Python, PowerShell, Bash, AWS, Azure, GCP
Responsibilities
Serve as technical lead and escalation point for complex AppSec and Attack Surface Management work; Provide expert-level leadership for security tools, platforms, and assessment methodologies; Lead design and execution of security assessment, response, and risk governance processes; Drive integration of security controls into CI/CD pipelines; Design and evolve security policies aligned to SOX, NIST, PCI DSS; Evaluate and vet new security technologies; Develop proof-of-concept exploits to validate remediation; Provide mentorship to junior team members; Define requirements for workflow orchestration and automation.
Seniority
Senior, hands-on IC with strategic leadership