Application Security Lead

About the role

This role leads application security across the organization, covering threat modeling, secure design reviews, security testing, vulnerability management and developer enablement. It also supports incident response, bug bounty intake, supply chain security and collaboration with GRC on compliance.

Key responsibilities

• Conduct threat modeling and secure design reviews for new features, services and architectures.
• Perform and oversee manual code reviews and security assessments of web, API, mobile and cloud-native applications.
• Design, implement and tune SAST, DAST, SCA, secrets scanning and IaC scanning within CI/CD pipelines.
• Run and coordinate penetration tests and vulnerability assessments, triaging and prioritizing remediation by risk and business impact.
• Build and maintain secure coding standards, reusable secure libraries and guardrails for developers.
• Manage software supply chain security, including dependencies, SBOMs and third-party component review.
• Run and mature the security champions program, delivering developer training and workshops.
• Support incident response for application-layer security events, including root cause analysis and lessons learned.
• Manage bug bounty and responsible disclosure intake and coordinate fixes with engineering owners.
• Define and report AppSec metrics (e.g., mean time to remediate, vulnerability density, coverage) to leadership.
• Mentor junior engineers and help with hiring and team capability development.
• Collaborate with GRC to map technical controls to compliance frameworks and support audits.

Required profile

• 5-8+ years of experience in application security, secure software engineering or a related field.
• 7-10 years of work experience.
• Proven experience conducting threat modeling (e.g., STRIDE, PASTA, attack trees).
• Experience integrating security into CI/CD pipelines and DevOps workflows.

Required skills

• Deep knowledge of OWASP Top 10, OWASP ASVS, CWE and common vulnerability classes.
• Hands-on experience with tools such as Burp Suite, Semgrep, CodeQL, Snyk, Checkmarx or SonarQube.
• Solid understanding of OAuth 2.0, OIDC, SAML, JWT and cryptography fundamentals.
• Working knowledge of cloud security on AWS, Azure or GCP, and of containers and Kubernetes security.
• Strong proficiency in at least one major language (e.g., Python, Java, Go, JavaScript/TypeScript, C#) and ability to review code in several.