Applications Security Manager

Role & responsibilities

• Lead and manage the organizations Application Security program across the SDLC.
• Define and implement secure coding standards, security policies, processes, and governance frameworks.
• Drive DevSecOps integration by embedding security controls into CI/CD pipelines.
• Oversee SAST, DAST, SCA, API security, container security, penetration testing, and vulnerability management.
• Conduct threat modeling and security architecture reviews for applications and APIs.
• Identify, assess, prioritize, and remediate application security vulnerabilities and risks.
• Partner with engineering, DevOps, cloud, product, and infrastructure teams to improve security posture.
• Establish application security metrics, dashboards, KPIs/KRIs, and executive reporting.
• Lead security assessments, audits, compliance initiatives, and remediation programs.
• Manage and mentor Application Security engineers and security champions.
• Evaluate and manage security tools, vendors, and external penetration-testing partners.
• Stay current with emerging application security threats, vulnerabilities, attack techniques, and industry best practices.

Preferred candidate profile

• 5 to 10 years of experience in Application Security, Product Security, Cybersecurity, or Information Security, with demonstrated leadership experience.
• Strong hands-on knowledge of OWASP Top 10, API Security, Secure SDLC, DevSecOps, threat modeling, SAST, DAST, SCA, and penetration testing.
• Experience securing applications across web, mobile, APIs, microservices, cloud, containers, and CI/CD environments.
• Proficiency with tools such as Burp Suite, Snyk, Checkmarx, Fortify, SonarQube, Veracode, or equivalent.
• Good understanding of AWS/Azure/GCP, Docker/Kubernetes, Git, CI/CD, OAuth2/OIDC, JWT, and common application architectures.
• Ability to perform or guide secure code reviews and vulnerability assessments.
• Strong understanding of security frameworks and standards such as NIST, ISO 27001, OWASP SAMM, and NIST SSDF.
• Excellent analytical, communication, stakeholder-management, and team-leadership skills.
• Experience building security programs, defining KPIs, managing risk, and influencing engineering teams.
• Bachelors degree in Computer Science, IT, Cybersecurity, Information Security, or a related field; relevant certifications such as CISSP, CISM, CSSLP, OSCP, or OSWE are advantageous.