Application Security Director

Description

Summary:

The Application Security Director provides leadership to managers and professional staff responsible for enterprise application security, secure development, software assurance, software supply chain security, cloud-native security, API security, and emerging technology risk. This role is accountable for the performance and results of multiple related teams, develops departmental plans and priorities, and serves as an industry expert and strategic advisor for enterprise application security risk management.

Duties and Responsibilities:

Enterprise Application Security Strategy

Define and evolve the enterprise Application Security vision, strategy, operating model, governance framework, control objectives, and multi-year roadmap aligned to business, technology, and cybersecurity objectives.

Provide leadership across managers, professional staff, and related teams responsible for application security testing, secure SDLC, software assurance, DevSecOps, API security, AI security, and software supply chain risk.

Shape cybersecurity and technology strategy by influencing investment decisions, resource allocation, security architecture standards, platform direction, risk acceptance, and remediation priorities.

Develop departmental plans, annual priorities, program objectives, staffing strategies, service models, and governance outcomes that improve application security maturity and enterprise resilience.

Lead strategy for the organization’s most critical applications, digital platforms, cloud environments, customer-facing services, mergers and acquisitions, and emerging technology initiatives.

Define and execute the enterprise vision for AI-enabled Application Security, integrating advanced analytics, automation, Generative AI, and secure-by-design principles throughout the SDLC to proactively identify, prioritize, report, remediate, and validate application security exposures while enabling secure innovation and reducing organizational risk.

Lead strategic collaboration and information sharing across the financial services sector, serving as an active member of FS-ISAC and other trusted industry forums to exchange application security intelligence, secure development practices, software supply chain risk insights, and emerging threat trends that strengthen organizational resilience and support collective cyber defense.

Risk Governance, Executive Reporting & Regulatory Leadership

Establish enterprise measurement strategy, KRIs, KPIs, exposure metrics, predictive analytics, executive dashboards, board-ready reporting, and regulatory evidence approaches for application security risk.

Translate complex technical risk into executive-ready business narratives that support risk committees, audit committees, senior leaders, regulatory discussions, and investment decisions.

Anticipate business, regulatory, technology, and threat landscape changes and recommend strategic improvements to products, processes, controls, services, and operating models.

Serve as senior escalation authority for significant application security incidents, strategic risk decisions, complex remediation disputes, software supply chain events, and high-risk exceptions.

Enterprise Influence, Talent & Industry Leadership

Lead multiple related teams by setting priorities, allocating resources, developing leaders, and aligning work to organizational objectives and annual plans.

Represent the Application Security function in executive forums, regulatory interactions, audit discussions, industry forums, peer groups, and strategic vendor engagements.

Champion secure-by-design, secure-by-default, developer enablement, automation, continuous validation, exposure management, and advanced security engineering practices across the enterprise.

Build organizational capability through talent development, leadership coaching, technical communities of practice, standards, reference architectures, and knowledge-sharing forums.

Basic Qualifications:

• Min 6 yrs of experience in Information Security, preferably in the Operations domain
• Min 4 years of Application Development (new)
• Min 4 yrs of experience in a Leadership role
• Associate's Degree

Preferred Qualifications:

• 10 or more years of progressive experience across application security, cybersecurity, technology risk, secure software development, software assurance, or related technology disciplines, including leadership of managers or multiple teams.
• Recognized industry expertise in application security, secure SDLC, software assurance, DevSecOps, AI security, API security, cloud security, software supply chain security, security architecture, or cyber risk governance.
• Demonstrated success establishing enterprise strategies, operating models, governance frameworks, technical standards, measurement strategies, and measurable risk reduction outcomes.
• Deep expertise in OWASP, NIST SSDF, NIST CSF, CWE, CVSS, ATT&CK, AI security frameworks, cloud-native architectures, APIs, containers, Kubernetes, Infrastructure-as-Code, and secure software governance.
• Extensive experience advising executives, risk committees, audit committees, regulators, senior technology leaders, and business stakeholders on application security strategy, risk, and investment decisions.
• Experience leading programs supporting cloud transformation, digital modernization, mergers and acquisitions, developer security enablement, secure-by-design initiatives, software supply chain governance, and continuous security validation.
• Proven ability to solve complex operational and organizational problems by leveraging resources within and outside the department and persuading leaders to take action.
• Published thought leadership, conference participation, industry engagement, regulatory interaction, peer group leadership, or recognized cybersecurity community expertise strongly preferred.
• Advanced certification preferred, such as CISSP, CSSLP, CISM, CRISC, CCSP, OSWE, GWAPT, GWEB, GIAC, SABSA, AWS Security Specialty, Azure Security Engineer Expert, or equivalent recognized expertise.
• Exempt Status: (Yes   = not eligible for overtime pay) ( No   = eligible for overtime pay)
• Yes
• Workplace Type: Remote
• Our Approach to Office Workplace Type
• Certain positions outside our branch network may be eligible for a flexible work arrangement. We’re combining the best of both worlds:  in-office and work from home. Our approach enables our teams to deepen connections, maintain a strong community, and do their best work. Remote roles will also have the opportunity to come together in our offices for moments that matter. Specific work arrangements will be provided by the hiring team.