Lead, Application Security

Description

The company is a large financial services institution that builds its technology in-house, with digital transformation part of how the Global Technology team works.

This is a senior individual contributor and lead role on the Attack Surface Management team, shaping the enterprise application security program together with senior security leaders, the Information Security Office, the Chief Technology Office, and global engineering teams.

The work covers cloud-native and DevOps environments, aiming to build secure-by-design outcomes and measurable risk reduction across the company's digital ecosystem, and to affect future architecture and engineering practice.

You will be the senior escalation point and technical authority on hard, ambiguous problems, where judgment, experience, and influence matter most.

The ideal candidate has deep knowledge of modern application architecture, cloud security, and DevSecOps, and wants to scale security through automation, policy-as-code, and engineering-first solutions.

Job classification: Technology, Information Security.

Responsibilities

• Act as technical lead and escalation point for complex operational and project work across application security and attack surface management.
• Provide expert technical leadership on AppSec tools, platforms, and assessment methods.
• Lead the design, evolution, and running of assessment, response, and risk governance processes for application security.
• Use deep AppSec and DevSecOps knowledge to solve complex technical, process, and organizational problems that affect risk.
• Bridge AppSec, DevOps, Cloud, and business teams so security requirements are clear, actionable, and tied to delivery goals.
• Work with senior leaders to define the future-state application security vision, grounded in hands-on operational insight.
• Lead the maturing of vulnerability and configuration monitoring across first-party, third-party, and open-source software.
• Drive security controls into CI/CD pipelines, with automated enforcement, monitoring, and reporting.
• Design and evolve security policies, standards, and alerting aligned to SOX, NIST, PCI DSS, and other regulatory frameworks.
• Evaluate and vet new security technologies, and give strategic recommendations and technical due diligence.
• Use qualitative and quantitative analysis to improve developer experience, security results, and adoption of secure-by-design practices.
• Promote secure-by-design across the SDLC through guidance, standards, tooling, and hands-on work.
• Validate and record compensating controls and mitigations that manage risk until remediation is complete.
• Make sure risk and performance metrics give an accurate picture of application security posture to executives and regulators.
• Write and maintain technical documentation, standards, and SOPs that raise program maturity.
• Build proof-of-concept exploits in lab environments to show exploitability and confirm remediation works.
• Mentor and guide junior team members to raise team capability and consistency.
• Define requirements for workflow orchestration and automation that manage application security posture at enterprise scale.

Requirements

• A bachelor's degree in computer science or engineering, or equivalent formal experience in a related field.
• Deep working knowledge of vulnerability frameworks and data sources, including CVE, CVSS, EPSS, and CWE.
• Proven record of leading and maturing application security and vulnerability management programs.
• Ability to work with engineering teams to confirm findings, cut false positives, and drive effective fixes.
• Engineering mindset, with strong systems thinking and problem solving.
• Clear written and spoken communication, able to explain technical and business risk to different audiences.
• Experience in agile and DevSecOps environments.
• Hands-on use of OWASP Top 10, OWASP WSTG, PTES, and MITRE ATT&CK.
• Deep experience with SAST, SCA, DAST, and ASPM tools.
• Strong grasp of software composition analysis, SBOMs, and supply chain risk.
• Preferred: scripting and automation in Python, PowerShell, or Bash.
• Preferred: exploit validation and web application penetration testing experience.
• Preferred: strong understanding of threat actors and real-world attack techniques.
• Preferred: knowledge of NIST, CIS, and PCI DSS standards and frameworks.
• Preferred: experience applying Agentic AI or AI-assisted approaches to security use cases.
• Preferred: advanced security certifications such as OSCP, GPEN, GWAPT, CASP+, GCSA, GCFA, or GCIH.
• Preferred: cloud certifications for AWS, Azure, or GCP.
• Preferred: demonstrated ability to influence without authority and lead through expertise.

Conditions

Salary range is $123,700.00 to $204,100.00. Actual pay may vary within this range based on location, candidate experience, and skills, and the range applies to residents in applicable states where the law requires it.

Equal opportunity: the company may use identity verification in hiring, and will get your consent before any verification.

Benefits

• Market-competitive base salary with yearly bonus potential at every level.
• Discretionary annual incentive program, subject to program rules; any award depends on individual and organizational performance.
• Medical, dental, vision, life, and disability insurance, paid time off, and leave of absence including parental and military leave.
• 401(k) with company match of up to 4%.
• Company-funded pension plan.
• Wellness reimbursement of up to $1,600 a year for personal wellbeing items.
• Work/life resources covering parenting, housing, senior care, finances, pets, legal matters, education, emotional and mental health, and career development.
• Education benefit to help fund traditional college enrollment toward an approved degree and many accredited certificates.
• Employee Stock Purchase Plan: shares bought at 85% of the lower of the price at the start or end of the purchase period.
• Some benefits may not apply to part-time employees scheduled for fewer than 20 hours a week.