Sr. Manager, Application Security

We are looking for a Sr. Manager, Application Security

We are seeking an experienced and technically hands-on Senior Manager of Application Security to lead and advance our enterprise application security program. This individual will bring a strong background in offensive security, application penetration testing, threat modeling, secure architecture, and enterprise application security leadership.

Responsibilities:

• Lead and develop an application security team responsible for application security assessments, penetration testing, threat modeling, and secure architecture reviews.
• Own and continuously mature the enterprise application security program, policies, standards, and governance.
• Establish and enforce Secure SDLC requirements across application development teams and business units.
• Oversee application security reviews, vulnerability management, remediation tracking, and program effectiveness.
• Improve application security review completion rates, assessment processes, and overall security program maturity.
• Provide technical direction, mentorship, and guidance to application security engineers.
• Establish meaningful security metrics and reporting to communicate application risk and program performance to leadership.
• Lead and perform hands-on application penetration testing and vulnerability assessments across web applications, APIs, and enterprise systems.
• Conduct manual security testing to identify vulnerabilities and attack paths that automated scanning tools may overlook.
• Review application source code to identify security weaknesses, insecure coding practices, authorization issues, and business logic vulnerabilities.
• Utilize Burp Suite and other offensive security tools to intercept, manipulate, analyze, and test application traffic.
• Independently validate and reproduce vulnerabilities identified through automated security tools and AI-powered scanning platforms.
• Assess authentication, authorization, session management, encryption, API security, data protection, and application security controls.
• Develop actionable technical findings and partner with development teams to drive vulnerability remediation.
• Lead and facilitate threat modeling exercises for new and existing applications, systems, and enterprise architectures.
• Evaluate application designs, identify trust boundaries, analyze data flows, and assess potential attack paths.
• Identify architectural security weaknesses involving authentication, authorization, encryption, system integrations, and sensitive data transmission.
• Challenge architectural assumptions and provide security recommendations during application design and development.
• Partner with engineering and architecture teams to incorporate security controls early in the development lifecycle.
• Establish scalable threat modeling methodologies and repeatable security review processes.
• Drive adoption and enforcement of enterprise Secure SDLC policies and application security standards.
• Partner with software engineering and DevOps teams to integrate security testing into CI/CD pipelines.
• Oversee the integration and effective use of SAST, DAST, SCA, and application security posture management (ASPM) platforms.
• Evaluate, select, and implement application security technologies to improve vulnerability detection and enterprise risk visibility.
• Ensure automated security findings are appropriately validated, prioritized, and remediated.
• Develop secure coding standards and provide practical guidance to development teams.
• Balance security requirements with development velocity and business objectives.
• Drive initiatives to leverage AI and automation to improve application security assessments, deep code reviews, threat modeling, and vulnerability identification.
• Evaluate opportunities to incorporate AI-powered tools and agentic workflows into enterprise application security processes.
• Assess and address emerging security risks associated with LLMs and AI-enabled applications.
• Evaluate risks involving prompt injection, insecure agent behavior, sensitive data exposure, RAG architectures, and access control weaknesses.
• Continuously evolve application security capabilities to address emerging technologies and changing threat landscapes.
• Support product cybersecurity initiatives and enterprise security requirements.
• Partner with engineering and product teams to incorporate security into product design, development, and deployment.
• Support cybersecurity compliance initiatives and evolving regulatory requirements, including the EU Cyber Resilience Act (CRA).
• Establish security standards for encryption, secure coding, APIs, data sanitization, and application architecture.
• Collaborate with cross-functional stakeholders to assess product and application security risks and implement appropriate controls.
• Serve as a trusted security advisor to engineering, architecture, product, and business stakeholders.
• Communicate complex technical vulnerabilities and architectural risks in a clear, actionable manner.
• Influence development teams to prioritize and remediate security issues.
• Build strong partnerships across the organization to improve security awareness and adoption.
• Mentor security engineers and foster a technically strong, collaborative application security team.

Requirements:

• 8 years of cybersecurity experience, with significant experience in application security, offensive security, penetration testing, or product cybersecurity.
• Previous experience leading an application security team, security engineering function, or enterprise application security program.
• Demonstrated hands-on experience conducting application penetration testing and manual vulnerability assessments.
• Strong proficiency with Burp Suite and other application security testing tools.
• Experience reviewing application source code and identifying complex security vulnerabilities.
• Strong understanding of web application security, API security, authentication, authorization, and common application attack techniques.
• Demonstrated experience leading or conducting threat modeling and secure architecture assessments.
• Understanding of trust boundaries, application data flows, encryption, and security control implementation.
• Experience developing or enforcing Secure SDLC policies and integrating security into CI/CD pipelines.
• Experience working with software engineering and architecture teams to identify and remediate security vulnerabilities.
• Strong leadership, communication, and stakeholder management skills.

Required Skills:

• Offensive security and application penetration testing.
• Threat modeling and secure architecture assessments.
• Secure SDLC policies and CI/CD security integration.
• Application security testing tools, such as Burp Suite.
• Leadership and communication skills.

Preferred Skills:

• OSCP, OSWE, GPEN, GWAPT, or other relevant offensive security certifications.
• Experience with enterprise SAST, DAST, SCA, and ASPM platforms.
• Experience with DevSecOps, CI/CD security integration, and application security automation.
• Familiarity with Azure, cloud application security, and modern enterprise application architectures.
• Experience with AI-native application security, AI-assisted code review, and automated threat modeling.
• Knowledge of LLM security, prompt injection, RAG security, and agentic AI risks.
• Experience with product cybersecurity and regulatory frameworks such as the EU Cyber Resilience Act.
• Experience in semiconductor, aerospace, manufacturing, financial services, or other complex enterprise technology environments.