The Global Application Security Lead owns the day-to-day execution of the application security and DevSecOps program across all business units and regions. The role is responsible for the security controls embedded in the software development lifecycle, from secure design and threat modeling through static and composition analysis, dynamic testing, secrets management, and production hardening.

This is a hands-on technical leadership role with people management responsibility. The Lead manages the application security engineering team, sets the working standards that engineering teams follow, runs the AppSec tooling estate, and performs and directs application-level testing. Strategy, budget, and executive reporting sit with the Global Enterprise Security Architect; the Lead is accountable for delivery against that strategy, for the technical quality of the program, and for the performance and development of the team.

Position Details
Reports To: Global Enterprise Security Architect, Security Architecture and Engineering (SA&E)
Location: Kansas City, MO. In-office three days per week.
Travel: Periodic travel to regional technology hubs.
Coverage: Supports engineering teams across US, UK, MENA, and APAC time zones.
Direct Reports: 2 application security engineers, plus technical direction of LGCC offshore engineering resources.

Core Responsibilities
Program Delivery
•    Execute the phased application security roadmap set by the Global Enterprise Security Architect, owning milestone delivery, dependencies, and status reporting
•    Operate the tiered application governance model (T1/T2/T3), including risk tiering intake, control expectations per tier, and periodic re-tiering of the application portfolio
•    Define and maintain secure SDLC standards, secure coding guidelines, and control gates at each stage of the development pipeline
•    Track and report AppSec operational metrics: scan coverage, finding volume by severity, mean time to remediate, SLA adherence, and exception backlog
•    Maintain the application security exception and risk acceptance register, escalating material risk to the Global Enterprise Security Architect

Technical Ownership
•    Own the AppSec tooling estate end to end: SAST, SCA, DAST, secrets scanning, and container and IaC scanning, including deployment, tuning, rule management, and pipeline integration
•    Lead tooling proof of concept exercises, define evaluation criteria, run technical bake-offs, and produce recommendation documentation for architecture review
•    Perform and direct internal application penetration testing, manual code review, and threat modeling on Tier 1 and high-risk applications
•    Triage findings across all sources, validate exploitability, remove false positives, and drive remediation with owning engineering teams
•    Manage third-party penetration test scoping, vendor coordination, finding validation, and retest closure
•    Maintain and enforce guardrails for AI-assisted development, including approved AI coding tools, agentic tooling, MCP server usage, and dependency provenance controls addressing supply chain and slopsquatting risk

Team Leadership and People Management
•    Build, lead, and develop the application security engineering team, including onshore staff and LGCC offshore engineering resources
•    Own hiring for the function: role definition, interview loop design, candidate assessment, and onboarding
•    Conduct performance reviews, set individual objectives, and manage performance concerns in partnership with HR
•    Define career paths, technical skill matrices, and individual development plans for application security engineers
•    Allocate work and manage team capacity against the program roadmap and inbound intake demand
•    Provide technical mentorship on secure code review, exploitation technique, tooling operation, and finding write-up quality
•    Provide input to headcount planning and offshore resourcing requests for review by the Global Enterprise Security Architect
•    Define runbooks, playbooks, and repeatable procedures so that AppSec operations are not dependent on individual knowledge
•    Manage day-to-day coordination and handoffs across US, UK, MENA, and APAC time zones

Cross-Functional Partnership
•    Partner with Engineering, DevOps, Platform, and Product teams to embed controls into delivery workflows with minimal friction to release velocity
•    Act as first-line technical escalation for application security findings, remediation disputes, and release blocking decisions, escalating unresolved risk decisions upward
•    Support GRC and audit teams with evidence, control narratives, and testing artifacts for NYDFS 23 NYCRR 500, HITRUST, GDPR, and DORA obligations
•    Support incident response for software-related incidents, including vulnerability triage, exploit analysis, and root cause contribution
•    Translate technical findings into business impact for application owners and non-technical stakeholders

Security Champions and Culture
•    Operate the Security Champions program within engineering teams, including champion selection, enablement content, and recurring working sessions
•    Deliver secure coding training and targeted enablement based on observed defect patterns in the codebase
•    Drive shift-left adoption so that security defects are found and fixed in development rather than at release gates
 

•    10 years in application security, product security, or secure software engineering, including 2 years in a lead or management capacity
•    Demonstrated people management experience, including hiring, performance management, and career development of security or engineering staff
•    Experience leading distributed teams across multiple time zones, including offshore engineering resources
•    Demonstrated hands-on experience operating SAST, SCA, DAST, and secrets scanning tooling at enterprise scale, including pipeline integration and rule tuning
•    Proven ability to perform manual secure code review and application penetration testing, with working command of Burp Suite Pro or equivalent
•    Working knowledge of at least two of: .NET, Java, Python, JavaScript/TypeScript, Go
•    Practical experience securing CI/CD pipelines and cloud-native workloads, with preference for Azure and Azure DevOps or GitHub Actions
•    Fluency with OWASP Top 10, OWASP ASVS, OWASP SAMM or BSIMM, and CWE
•    Experience supporting regulatory or certification audits in a regulated industry
•    Ability to write clear, structured technical findings and standards documentation for both engineering and audit audiences

Preferred Qualifications
•    Financial services, insurance, or other regulated industry experience
•    Experience with software supply chain security, SBOM generation, and dependency provenance controls
•    Experience defining controls for AI-assisted development tooling and AI-generated code review
•    Certifications such as OSWE, OSCP, GWAPT, CSSLP, or CISSP

First 12 Months - Success Measures
•    AppSec tooling deployed and integrated across 80% of Tier 1 and Tier 2 repositories with agreed scan coverage
•    Risk tiering completed for the full application portfolio and control expectations published per tier
•    Remediation SLAs defined, agreed with engineering leadership, and reported monthly
•    Security Champions program operating with named champions in each major engineering group
•    AI-assisted coding guardrails implemented and adoption measured across the developer population
•    Team structure, role expectations, and individual development plans established for all direct reports

#LI-JM