{"id":158124,"url":"https://alion.io/job/apex-group-head-of-application-security","title":"Head of Application Security","company":{"id":7414,"name":"Apex Group","domain":"apexgroup.com","url":"https://alion.io/company/apex-group-ltd","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"C","score":68,"open_postings":392,"ghost_share":0.528,"stale_share":0,"repost_share":0.003,"time_to_fill_p50_days":26,"computed_at":"2026-10-31T05:58:55Z"}},"role":"Leadership","role_family":"Leadership","seniority":"head","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Cape Town, South Africa"],"countries":["ZA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":44000,"max_usd":99000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":4188},"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agile","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"Defense in Depth","optional":false},{"name":"GitHub","optional":false},{"name":"GitLab","optional":false},{"name":"ISO 27001","optional":false},{"name":"OWASP","optional":false},{"name":"Platform Engineering","optional":false},{"name":"SOC 2","optional":false},{"name":"Threat Modeling","optional":false}],"status":"live","first_seen_at":"2026-06-11T00:00:00Z","employer_posted_date":"2026-06-11","last_verified_at":"2026-10-31T17:18:40Z","board_verified":true,"closed_at":null,"days_open":143,"trust":{"level":"ghost","repost_count":0,"flags":["stale","company_stale"],"days_open":142},"description":"The Apex Group was established in Bermuda in 2003 and is now one of the world’s largest fund administration and middle office solutions providers.\nOur business is unique in its ability to reach globally, service locally and provide cross-jurisdictional services. With our clients at the heart of everything we do, our hard-working team has successfully delivered on an unprecedented growth and transformation journey, and we are now represented by over circa 13,000 employees across 112 offices worldwide.Your career with us should reflect your energy and passion.\nThat’s why, at Apex Group, we will do more than simply ‘empower’ you. We will work to supercharge your unique skills and experience.\nTake the lead and we’ll give you the support you need to be at the top of your game. And we offer you the freedom to be a positive disrupter and turn big ideas into bold, industry-changing realities.\nFor our business, for clients, and for you\nThe Role\nApex is seeking a Head of Application Security to lead and mature its global Application Security capability. This is a senior leadership position responsible for defining strategy, setting standards, and driving execution across key domains: Application Security, DevSecOps, AI Security, and Cloud-Native Application Security[WJ1.1] Engineering.\nAs the Apex’s senior authority for secure software and platform delivery, you will ensure that security is embedded by design throughout the technology lifecycle-enabling engineering teams to innovate rapidly and safely while maintaining compliance with regulatory and business requirements.\nKey Responsibilities[WJ2.1]\nDefine and own the global Application Security strategy aligned to Apex’s cyber risk posture and regulatory obligations.\nEnsure developers meet KPI’s and business deliverables.\nEnsure developers keep up with emerging threats and technologies.\nLead and develop multiple security engineering teams across Application Security, DevSecOps, AI & Data Security[WJ3.1], and Cloud & Infrastructure[WJ4.1] Developer Platform Security.\nServe as the senior security authority for application, platform, and DevSecOps-related design and engineering decisions.\nEnsure security controls are documented and [WJ5.1]embedded throughout the software development lifecycle (SDLC) and CI/CD pipelines.\nOversee application threat modelling, secure design reviews, and architecture risk assessments.\nDrive adoption of secure coding standards, automated security testing (SAST, DAST, SCA), and secrets management.\nProvide oversight on cloud-native and infrastructure security patterns in hybrid and multi-cloud environments.\nDefine security guardrails for AI-enabled applications, data pipelines, and emerging technologies.\nPartner with Architecture, Engineering, Cloud, and Platform teams to deliver secure-by-default solutions.\nTranslate security policies and standards into practical, consumable engineering guidance.\nCommunicate application and platform risk to senior leadership and governance forums.\nSupport audit, regulatory, penetration testing and[WJ6.1] assurance activities related to application and platform security.\nExecute delegated tasks as deemed appropriate by the Group CISO and other empowered Group Cyber leadership authorities, ensuring timely and effective completion in alignment with organizational priorities.\nSupport the Group Cyber Strategy end-to-end, driving alignment of all activities, decisions, and deliverables with strategic objectives and business outcomes.\nAreas of Specialization\nApplication Security: Secure software architecture, threat modeling, secure design reviews, vulnerability management, and secure coding practices.\nDevSecOps: CI/CD pipeline security, automation of security controls, integration of security tooling, and developer enablement.\nCloud & Infrastructure Security: Secure cloud-native architectures, infrastructure-as-code security, and platform hardening across hybrid and multi-cloud environments.\nAI Security: Security and governance controls for AI-enabled applications, data pipelines, and emerging technologies.\nRequired Experience & Skills\nExperience: o 10+ years in cybersecurity, software engineering, or platform engineering roles. o 8+ years in senior management positions within security engineering, architecture, or similar leadership roles, with proven accountability for strategy, team leadership and delivery of enterprise-scale security programs. \nTechnical Expertise: [WJ7.1] o Strong hands-on understanding of application security architecture, threat modeling, and DevSecOps practices. o Proven experience in securing microservices architecture and API ecosystems. o Knowledge of Gitlab, GitHub and API security and integrations. o Experience securing applications and platforms in cloud environments (Azure, AWS and OCI). o Deep knowledge of security principles, secure design patterns, and defense-in-depth strategies.\nKnowledge of Standards: [WJ8.1] o Familiarity with frameworks such as NIST, ISO 27001, OWASP, SOC1 and SOC2. o Familiarity with Agile, iterative and incremental development models.\nLeadership Skills: o Demonstrated ability to lead, mentor, and develop high-performing security engineering teams across distributed or multi-location environments. o Proven track record influencing senior stakeholders and driving security initiatives aligned with business objectives.\nCommunication Skills: o Ability to articulate technical risks and security recommendations to both technical and non-technical stakeholders, including executive leadership and governance forums.\nQualifications\nRelevant certifications: CISSP, CCSP, CSSLP, AWS/Azure Security, or similar.\nExposure to architecture frameworks (SABSA, TOGAF).\nExperience in financial services or highly regulated environments.\nFamiliarity with AI security, data protection, and modern platform engineering models. What will you get in return:\nOpportunity to shape and lead a critical global security capability.\nExposure to enterprise-scale, cloud-native, and modern engineering environments.\nCollaboration with senior security, architecture, and technology leaders across the organisation.\nA strong focus on team development, ownership, and career growth.\nDisclaimer: Unsolicited CVs sent to Apex (Talent Acquisition Team or Hiring Managers) by recruitment agencies will not be accepted for this position. Apex operates a direct sourcing model and where agency assistance is required, the Talent Acquisition team will engage directly with our exclusive recruitment partners.","description_format":"text","description_chars":6521,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Custody & Fund Administration"],"lifecycle":[{"event":"open","at":"2026-06-11T00:00:00Z"}],"visa":[],"liveness":{"score":8,"band":"cold","label":"Long shot","p_open":1,"p_active":0.3,"p_room":0.28,"age_days":142,"expected_fill_days":26,"reasons":["conf:3","stale_co","velocity","ghost","win:tail","crowd:brand"],"computed_at":"2026-10-31T05:58:55Z"},"pay":null,"html_url":"https://alion.io/job/apex-group-head-of-application-security","json_url":"https://alion.io/job/apex-group-head-of-application-security.json","meta":{"generated_at":"2026-11-01T02:58:23Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4498,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-02T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":7414},"rest":"https://alion.io/mcp/rest/get_company?id=7414"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fapex-group-head-of-application-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fapex-group-head-of-application-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fapex-group-head-of-application-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/apex-group-head-of-application-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fapex-group-head-of-application-security"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":158124}},{"tool":"search_jobs","arguments":{"company":"apexgroup.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":158124},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}