Application Security Manager

About the company

• Position listed on behalf of a partner company that manages all applications and next steps.
• Partner is looking for a Senior Manager, Application Security based in Estonia.
• Fully remote technology environment.

Responsibilities

• Define and own the application security roadmap: vulnerability management, threat modeling, security reviews, remediation processes.
• Conduct hands-on security reviews, triage vulnerabilities, collaborate with engineers on remediation.
• Embed security-by-default practices across the SDLC: secure development standards, dependency management, secrets hygiene, automated scanning in CI/CD.
• Design and implement an AI-first application security strategy: AI-assisted code analysis, vulnerability triage, remediation agents, automated testing.
• Oversee third-party and vendor security assessments.
• Establish zero-trust principles and collaborate with cloud platform leadership on network security, IAM, logging, alerting.
• Lead application-layer security incident response.
• Manage and support the Compliance Lead and IT team.
• Align application security, IT operations, and compliance under a unified strategy.
• Oversee access reviews, identity governance, endpoint security, onboarding/offboarding.
• Partner with compliance leadership on frameworks and compliance maturity beyond SOC 2 Type II.
• Represent security posture to leadership, customers, prospects, and auditors.
• Own the security questionnaire and due diligence process.

Requirements

• At least 7 years of security experience, including substantial hands-on application security.
• Demonstrated success building or maturing an AppSec program: security reviews, threat modeling, vulnerability management, pentest follow-up.
• Strong knowledge of secure software design, OWASP principles, common application vulnerabilities, exploitation scenarios.
• Ability to read application code, evaluate modern web and API architectures.
• At least 2 years of people management experience.
• Experience leading security initiatives while remaining technically hands-on.
• Regular use of AI agents and AI-assisted development or security tools.
• Strong strategic communication skills.