Application Security Manager Product

Job Summary

We are looking for an experienced Application Security Manager to lead and manage application security initiatives across the organization, with a strong focus on Application Security, Product Security, AI Security, Secure SDLC, DevSecOps, vulnerability management, third‑party security assessments, and M&A integration. The role will partner closely with Product, Engineering, DevOps, Architecture, AI, TPRM, Infrastructure, and Security teams to embed security throughout the application lifecycle—from design and development through deployment and production. The ideal candidate will combine strong technical depth in application security with the ability to lead security assessments, influence engineering teams, manage security platforms, assess emerging AI risks, and communicate security risk effectively to technical and executive stakeholders.

Responsibilities

• Application Security & Veracode Platform Management
• Own and manage the organization's Veracode application security platform, including SAST application onboarding, scan configuration, platform administration, and operational support.
• Drive application onboarding and establish appropriate security scanning requirements based on application risk.
• Integrate application security testing into CI/CD pipelines and DevSecOps processes.
• Review, triage, and analyze application security findings and vulnerabilities.
• Provide remediation guidance to Product and Engineering teams and drive findings through closure.
• Support vulnerability prioritization based on severity, exploitability, business impact, and application risk.
• Troubleshoot scanning, integration, configuration, and platform-related issues.
• Manage coordination with the Veracode vendor and support teams.
• Develop application security dashboards, metrics, reports, and management-level insights.
• Establish and maintain application security onboarding, scanning, remediation, and exception-management processes.
• DAST & Application Security Testing
• Manage and coordinate Dynamic Application Security Testing (DAST) activities across the application portfolio.
• Review and validate DAST reports and security findings.
• Work with Product and Engineering teams to understand vulnerabilities and define remediation strategies.
• Coordinate DAST requirements, scheduling, execution, and remediation tracking.
• Collaborate with internal security teams, external security partners, and application teams to ensure effective DAST operations.
• Track vulnerabilities through closure and provide risk-based recommendations where immediate remediation is not feasible.
• Coordinate with relevant security stakeholders on penetration testing requirements and other applicable security assessments.
• Product Security & Secure SDLC
• Partner with Product and Engineering teams to define and implement security requirements throughout the Software Development Lifecycle.
• Conduct application security risk assessments and security architecture/design reviews.
• Review application architecture, design, code, integrations, APIs, data flows, and security controls.
• Assess applications against recognized security standards, including OWASP ASVS, addressing product security risks across both design and code layers.
• Ensure required security testing, including SAST, DAST, and SCA, is performed based on application risk and security requirements.
• Drive adoption of Secure SDLC and DevSecOps practices across Product and Engineering organizations.
• Provide security consultation from architecture and design through development, testing, deployment, and production.
• Identify security gaps and define appropriate remediation, mitigation, and compensating controls.
• Establish security checklists, standards, runbooks, processes, and reusable guidance for Product and Engineering teams.
• Track application security risks, vulnerabilities, remediation activities, exceptions, and security readiness.
• Support security reviews for new technologies, POCs, tools, application onboarding initiatives, and emerging technology platforms.
• AI Security & Agentic AI Security
• Conduct AI security risk assessments for AI-enabled applications, products, platforms, and use cases.
• Review AI architecture, security controls, data flows, integrations, access controls, and deployment models.
• Assess AI solutions against applicable security requirements and identify control gaps.
• Evaluate security risks associated with agentic AI, including agent autonomy, tool usage, access privileges, integrations, data access, and execution of actions.
• Review and assess agentic AI security controls as part of application and AI security assessments.