Application Security Manager

Responsibilities:

• Lead and mentor a team of application security engineers and penetration testers.
• Guide team members' daily project and operational activities.
• Manage and mature the application security program through direct interactions.
• Actively seek to improve our application security and penetration testing operations.
• Identify improvement opportunities in all processes and activities involved.
• Participate in security and technology strategic planning to ensure identified risk governance is incorporated into the enterprise strategy.
• Appropriately assess risk and provide software security advice when business decisions are made.
• Set strategies, processes and oversee the management and operations of SAST, SCA, DAST, and penetration testing operations to provide coverage for the application portfolio.
• Function as a subject matter expert in application, network and cloud penetration testing, scanning platforms, exploits, tools, and techniques.
• Build and execute a security testing strategy and lead AI-first transformation to improve effectiveness and efficiency of our services.
• Manage test resources to ensure maximum performance.
• Ensure secure outcomes of application and configuration testing.
• Oversee vulnerability identification and measurement.
• Guide development teams through a review of their applications and risks against common application flaws like OWASP Top 10 and others.
• Provide visibility to senior management along with context and prioritization of the issues.
• Operate as an advocate for Security in interactions with internal and external teams.
• Work with Risk & Compliance teams on SOC 2, PCI-DSS, HIPAA, and other audits as needed.
• Research and recommend policy and procedures as they relate to Application Security.
• Lead projects to implement security technologies for the entire enterprise.
• Define security guardrails through automated tool policies, SLAs, custom rules, and support the developer community.
• Help the enterprise manage vulnerabilities across automated tooling and manual security assessments.
• Work with Champions to build relationships and ensure key activities are supported and deliverables are achieved in a timely manner.
• Support the AppSec technical team and ensure relationships with Business and team are maximized.

Requirements:

• Four-year college diploma or university degree in computer science or computer engineering, and/or 5 years equivalent work experience in application development.
• Preferred certifications are listed as follows: OSCE3, OSCE, OSCP, OSWE, CCSAS, CCT, CRT, GXPN, CISSP or CSSLP or similar certification.
• 3+ years of experience.
• 8+ years of experience in enterprise-level application security.
• Previous experience leading teams of penetration testers strongly encouraged.
• Experience with cloud-based application architectures.

Skills

AppSec, Application Security, DAST, Penetration Testing, Pentest, SAST, SCA