Security Practices Director

Quick Facts

• Role: Security Practices Director (AppSec expertise)

Description

Lead and validate technical application security (AppSec) engagements for enterprise customers, translating security findings into prioritized, risk-based remediation roadmaps. Advise customers on how to securely implement and operate SaaS platforms day-to-day, including secure SDLC, vulnerability assessment, threat modeling, and pen-test interpretation. Help drive end-to-end delivery quality through scoping, staffing, timelines, risk ownership, and building reusable methodologies and playbooks.

Responsibilities

• Apply AppSec expertise (secure SDLC, vulnerability assessment, threat modeling, pen-test interpretation) to lead and validate technical security engagements
• Identify and advise on common application vulnerabilities (OWASP Top 10, injection, broken access control, SSRF, insecure deserialization)
• Advise on secure SaaS implementation and operation: configuration hardening, IAM (SSO, MFA, OAuth), integration/API security, data protection, and ongoing operational security hygiene
• Produce prioritized, risk-based remediation roadmaps for client stakeholders
• Lead end-to-end engagement delivery: scoping, staffing, timeline, and risk ownership
• Support pre-sales with discovery, solution scoping, SOW development, and executive presentations
• Serve as a trusted advisor to C-suite and senior security stakeholders (e.g., CISO, CTO, VP of IT Security)
• Oversee delivery teams to ensure consistent methodology and quality
• Develop reusable delivery accelerators, methodologies, and playbooks
• Mentor practice staff on both AppSec substance and client-facing engagement skills

Requirements

• 7–12+ years of hands-on AppSec experience across secure SDLC, vulnerability management, threat modeling, and pen testing
• Deep, working knowledge of OWASP Top 10 and common application-layer vulnerability classes with practical assessment/mitigation
• Practical understanding of securing a SaaS platform through implementation and ongoing use (configuration hardening, IAM, API/integration security, shared-responsibility model)
• Strong executive communication and presence; comfortable with CISO/CTO-level discussions
• Security certifications strongly preferred (CISSP, OSCP, or equivalent)

Benefits

• Time off programs
• Medical, dental, vision, and mental health support
• Paid parental leave
• Life and disability insurance
• 401(k)
• Employee stock purchasing program