Define and own the application security roadmap: vulnerability management, threat modeling, security reviews, remediation processes.
Conduct hands-on security reviews, triage vulnerabilities, collaborate with engineers on remediation.
Embed security-by-default practices across the SDLC: secure development standards, dependency management, secrets hygiene, automated scanning in CI/CD.
Design and implement an AI-first application security strategy.
Oversee third-party and vendor security assessments.
Establish zero-trust principles, collaborate on network security, IAM, logging, alerting.
Lead application-layer security incident response.
Manage and support the Compliance Lead and IT team.
Represent security posture and compliance to leadership, customers, auditors.
Requirements
At least 7 years of security experience, including substantial hands-on application security.
Demonstrated success building or maturing an application security program.
Strong knowledge of secure software design, OWASP principles, application vulnerabilities.
Ability to read application code, evaluate web and API architectures.
At least 2 years of people management experience.
Regular use of AI agents and AI-assisted development/security tools.