{"id":2498694,"url":"https://alion.io/job/gett-application-security-lead","title":"Application Security Lead","company":{"id":49170,"name":"Gett","domain":"gett.com","url":"https://alion.io/company/gett","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Comeet","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Tel Aviv, Israel"],"countries":["IL"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":101000,"max_usd":263000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":588},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"GCP","optional":false},{"name":"GDPR","optional":false},{"name":"ISO 27001","optional":false},{"name":"Least Privilege","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP SAMM","optional":false},{"name":"PCI DSS","optional":false},{"name":"Red Teaming","optional":false},{"name":"STRIDE","optional":false},{"name":"Threat Modeling","optional":false}],"status":"live","first_seen_at":"2026-10-13T06:58:25Z","employer_posted_date":"2026-10-13","last_verified_at":"2026-10-14T13:54:51Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Description\nGett is a Ground Transportation Solution with the mission to organize all the best mobility providers (delivery, corporate fleet, ride-hailing, taxi, enterprise solutions like car pooling, and more) in one global platform, with great UX - optimizing the entire experience from booking and riding to invoicing and analytics, to save businesses time and money. We work with a third of the Fortune 500 companies and have over 17K active business customers across the world.\nWe are seeking a highly skilled and hands-on Application Security Lead to take ownership of our product and infrastructure security. Reporting directly to the CISO with a dotted line to the CTO, you will act as the critical bridge between our Security and Engineering teams, driving a robust \"security-first\" culture.\nWhile this role encompasses both application and infrastructure security, our primary focus is on the Application Security domain. You will lead our transition towards a mature DevSecOps organization, ensuring that security is seamlessly embedded into every phase of our SDLC without compromising delivery speed.\nKey Responsibilities\nApplication Security & Secure Engineering\nSecure SDLC Integration: Embed security practices throughout the entire SDLC, from initial design and planning to deployment and maintenance.\n Threat Modeling & Architecture: Lead threat modeling (e.g., STRIDE) and architectural reviews for high-risk features like authentication, PII, and payments.\n AppSec Tooling & Automation: Integrate and manage automated security scanning (SAST, SCA, DAST) within CI/CD pipelines to ensure code integrity seamlessly.\n Mobile & API Security: Enforce least-privilege models for API configurations. Lead security initiatives specifically tailored to mobile environments (iOS/Android), protecting Gett's core mobility platform.\n Offensive Security & Pentesting: Orchestrate internal red teaming and external penetration tests for web and mobile applications. Manage Vulnerability Disclosure Programs (VDP) / Bug Bounties.\nDeveloper Empowerment & DevEx: Collaborate with developers to provide automated tools, coding guidelines, and frictionless guardrails for secure-by-design development, ensuring security acts as an enabler, not a blocker.\nIncident & Vulnerability Management: Act as the technical escalation point for application security incidents, leading detection and recovery efforts, while prioritizing vulnerabilities across the product suite for timely remediation.\nCloud & Infrastructure Security\n Cloud & Network Posture: Manage cloud security posture (CSPM) across AWS/GCP and oversee broad network security measures, including WAF, Bot management, and environment segmentation.\nPipeline & Secrets Management: Secure the CI/CD infrastructure against tampering and enforce robust secret management and secure repository controls across the organization.\n Resilience & Recovery: Manage disaster recovery (DR) and business continuity planning for production environments.\nGovernance, Culture & Compliance\nDevSecOps Strategy: Lead the strategic evolution of DevOps into a mature DevSecOps model, aligning with industry frameworks like OWASP SAMM and NIST SSDF.\n Metrics & Measurement: Define and track key security metrics (e.g., MTTR, vulnerability density) to measure and improve program effectiveness.\nSecurity Champions: Build and mentor a Security Champions program within R&D to scale security knowledge and foster a grassroots culture.\nCompliance & Privacy: Ensure continuous compliance with PCI-DSS, ISO27001, and GDPR, championing privacy-by-design principles across all user data and R&D operations.\nRequirements\nRequirements:\n 5+ years of proven experience with a strong emphasis on Application Security, Product Security, and Developer interaction. Cloud/Infrastructure security experience is highly valued but secondary to AppSec expertise.\nHands-on experience with AppSec tooling across the CI/CD pipeline, mobile application security (iOS/Android), and robust API security management.\nSolid understanding of cloud architectures (AWS/GCP), secret management, and security posture tools.\nDeep understanding of OWASP SAMM, NIST, Threat Modeling (STRIDE), and regulatory standards (PCI-DSS, GDPR).\nExceptional communication skills with the ability to bridge the gap between engineering, C-level executives (CISO/CTO), and security teams to embed a security culture seamlessly.\nAt Gett, we’re committed to creating an inclusive, respectful environment where everyone feels valued and empowered to succeed. We believe that diversity drives innovation, and we’re proud to offer equal opportunities to all-regardless of age, race, gender identity, sexual orientation, disability, or any other characteristic. If you need accommodations during the recruitment process, please contact us at  ,and we’ll do our best to support you. Click here to view our privacy policy.","description_format":"text","description_chars":4921,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Israel","iso":"IL","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Shared Mobility","Ride Hailing"],"lifecycle":[{"event":"open","at":"2026-10-14T05:23:26Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":23,"reasons":["conf:1","win:early"],"computed_at":"2026-10-14T06:34:16Z"},"pay":null,"html_url":"https://alion.io/job/gett-application-security-lead","json_url":"https://alion.io/job/gett-application-security-lead.json","meta":{"generated_at":"2026-10-14T15:27:48Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":19484,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":49170},"rest":"https://alion.io/mcp/rest/get_company?id=49170"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fgett-application-security-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fgett-application-security-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fgett-application-security-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/gett-application-security-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fgett-application-security-lead"}]}