We are seeking an experienced and visionary Director Application Security to lead the strategy, development, and execution of our Application Security program. Reporting to the Vice President of Security Operations, this leader will be responsible for maturing and optimizing application security capabilities across the software development lifecycle, ensuring secure-by-design principles are embedded into engineering practices while enabling rapid delivery of innovative products.
This individual will partner closely with Engineering, Product Management, Architecture, DevOps, Cloud Engineering, and Security Operations to integrate security into every phase of software development. The successful candidate will have extensive experience building or transforming Application Security programs within complex technology organizations and will possess the ability to influence engineering culture through collaboration rather than gatekeeping.
Role Responsibilities:
Application Security Strategy
Develop and execute the enterprise Application Security strategy aligned with business and technology objectives.
Build and mature a scalable Application Security program supporting modern software development practices.
Define the long-term roadmap for secure software development across cloud, web, mobile, APIs, and emerging technologies.
Establish secure-by-design principles and integrate them throughout the Software Development Life Cycle (SDLC).
Secure Development Lifecycle (SSDLC)
Lead the implementation and continuous improvement of a Secure Software Development Lifecycle (SSDLC).
Develop standards and security requirements for application development.
Partner with engineering teams to integrate security early within CI/CD pipelines.
Promote developer-friendly security practices that minimize friction while improving software security.
Security Testing & Assurance
Oversee enterprise application security testing, including:
Static Application Security Testing (SAST)
Dynamic Application Security Testing (DAST)
Software Composition Analysis (SCA)
Interactive Application Security Testing (IAST)
API Security Testing
Container Security
Infrastructure-as-Code (IaC) Security
Secure code reviews
Penetration testing coordination
DevSecOps Enablement
Partner with DevOps teams to embed automated security controls into CI/CD pipelines.
Improve automation of security testing and vulnerability management.
Reduce developer burden through integrated tooling and streamlined workflows.
Measure security effectiveness while enabling engineering velocity.
Operationalize Continuous Threat & Exposure Management (CTEM) across critical applications and business services
Define CTEM scope around critical business services, crown-jewel applications, sensitive data, material APIs, and externally exposed assets.
Consolidate exposure signals from application testing, attack-surface management, cloud security, vulnerability management, penetration testing, bug bounty, and threat intelligence.
Establish a common exposure taxonomy and risk model that incorporates exploitability, reachability, business criticality, threat activity, and compensating controls.
Maintain an evidence-backed view of application exposure rather than relying primarily on scanner severity.
Cloud & Modern Architecture Security
Provide application security guidance for:
Cloud-native applications
Microservices
APIs
Containers
Kubernetes
Serverless architectures
Artificial Intelligence and Machine Learning applications
Third-party integrations
Engineering Partnership
Build trusted relationships with engineering leadership.
Champion security as an engineering quality function.
Develop security champions programs across engineering organizations.
Leadership
Lead, mentor, and develop a high-performing Application Security team.
Establish performance metrics and operational objectives.
Manage vendor relationships and application security technologies.
Support hiring and organizational growth as the…