Lead, Application Security

What you'll do

• Lead the design, evolution, and execution of application security assessment and risk governance processes.
• Integrate security controls into CI/CD pipelines through automation and self-service enablement.
• Serve as the technical lead and escalation point for complex operational and project work across AppSec domains.
• Manage the maturation of vulnerability and configuration monitoring for first-party, third-party, and open-source software.
• Design and evolve security policies and alerting mechanisms aligned with SOX, NIST, and PCI DSS frameworks.
• Evaluate and vet new security technologies while providing strategic recommendations and technical due diligence.
• Develop proof-of-concept exploits in lab environments to demonstrate exploitability and validate remediation effectiveness.
• Provide mentorship and technical guidance to junior team members to raise overall team capability.

What we're looking for

• Bachelor of Computer Science/Engineering or formal experience in related fields.
• Proven experience leading and maturing application security and vulnerability management programs.
• Deep experience with SAST, SCA, DAST, and ASPM tooling.
• Deep familiarity with vulnerability and security frameworks and data sources such as CVE, CVSS, EPSS, and CWE.
• Hands-on experience with industry frameworks including OWASP Top 10, OWASP WSTG, PTES, and MITRE ATT&CK.
• Strong understanding of software composition analysis (SCA), SBOMs, and supply chain risk.
• Experience working in agile and DevSecOps environments.
• Scripting and automation experience in Python, PowerShell, or Bash (preferred).
• Experience performing exploit validation and web application penetration testing (preferred).
• Advanced security certifications such as OSCP, GPEN, GWAPT, CASP+, GCSA, GCFA, or GCIH (preferred).
• Cloud certifications in AWS, Azure, or GCP (preferred).