Application Security Team Lead

Job Description

We are looking for an Application Security Team Lead to own and drive the application security program while leading a small, high-performing team of security engineers. This is a hands-on leadership role: you will conduct penetration tests and threat models, set team direction, mentor engineers, and partner with stakeholders across the organization.

You will be responsible for the strategy, execution, and continuous improvement of application security across products, APIs, and AI-powered services. You will lead a team of 2 to 4 security engineers, helping them grow while ensuring the team delivers measurable impact on the organization’s security posture.

What you’ll deliver

• Lead and grow a team of Application Security Engineers, setting direction, coaching, and owning the AppSec roadmap and KPIs.
• Drive end-to-end application security: threat modeling, design reviews, internal penetration testing, manual and automated code reviews, and security testing (SAST/DAST/IAST/SCA).
• Own vulnerability management and bug bounty: define processes and SLAs, triage and validate findings, and drive remediation with engineering teams.
• Define and optimize the AppSec tooling stack, integrating security into CI/CD and developer workflows to shift left without slowing delivery.
• Secure AI/ML features and LLM integrations, assess AI-specific risks, and define guardrails and best practices for safe adoption.
• Set secure coding standards (OWASP) and scale a security-first culture through training, documentation, and security champion initiatives.

Qualifications

• Significant professional experience in Application Security, Product Security, or Secure Software Development, with a demonstrated track record of leading or mentoring security engineers.
• Proven ability to lead a small team: set priorities, delegate effectively, develop people, and deliver results through others while remaining technically hands-on.
• Deep understanding of common vulnerability classes, including injection, broken access control, cryptographic failures, and SSRF, as well as secure design principles.
• Strong hands-on experience with penetration testing of web applications, APIs, and modern cloud-native architectures.
• Solid knowledge of authentication, authorization, cryptography, and API security patterns.
• Experience building or maturing an application security program, including processes, tooling strategy, and metrics.
• Experience with security testing methodologies and tools across SAST, DAST, IAST, and SCA.
• Familiarity with microservices architectures and cloud environments, particularly AWS.
• Excellent communication skills, with the ability to articulate technical risks to engineers, translate security priorities for leadership, and build trust across teams.

Benefits

• 100% remote work, Wi-Fi reimbursement, an equipment stipend, and a provided MacBook laptop.
• Unlimited vacation days.
• Private medical care for you and your dependents.
• Wellness programme.
• Company-wide shutdowns in August and around Christmas.

Additional Information

This is an Equal Employment Opportunity and Affirmative Action employer. Employment decisions are made without discrimination based on legally protected characteristics.