Application Security Director

Huntington National Bank•Columbus, OH

4d•Remote

About The Position

The Application Security Director provides leadership to managers and professional staff responsible for enterprise application security, secure development, software assurance, software supply chain security, cloud-native security, API security, and emerging technology risk. The role is accountable for the performance and results of multiple related teams, develops departmental plans and priorities, and serves as an industry expert and strategic advisor for enterprise application security risk management. The Director defines and evolves the enterprise Application Security vision, strategy, operating model, governance framework, control objectives, and multi-year roadmap in alignment with business, technology, and cybersecurity objectives. The role shapes cybersecurity and technology strategy by influencing investment decisions, resource allocation, security architecture standards, platform direction, risk acceptance, and remediation priorities. It leads strategy for critical applications, digital platforms, cloud environments, customer-facing services, mergers and acquisitions, and emerging technology initiatives, including the use of AI-enabled security capabilities throughout the software development lifecycle. The position establishes enterprise measurement and reporting approaches for application security risk, including KRIs, KPIs, exposure metrics, predictive analytics, executive dashboards, board-ready reporting, and regulatory evidence. It translates technical risk into business-focused narratives for executives, committees, auditors, regulators, and other stakeholders, and serves as a senior escalation authority for significant incidents, risk decisions, remediation disputes, software supply chain events, and high-risk exceptions. The Director leads multiple related teams by setting priorities, allocating resources, developing leaders, and aligning work to organizational objectives. The role represents Application Security in executive, regulatory, audit, industry, peer, and vendor forums; champions secure-by-design and developer enablement; and builds organizational capability through talent development, coaching, technical communities, standards, reference architectures, and knowledge sharing. The position also supports industry collaboration and information sharing, including active participation in FS-ISAC and other trusted forums. The position is remote. The hiring team will provide details about specific work arrangements. The compensation range is not specified in the posting. Colleagues are eligible to participate in an applicable incentive compensation plan and receive a variety of benefits.

Requirements

At least 6 years of experience in Information Security, preferably in the Operations domain.
At least 4 years of Application Development experience.
At least 4 years of experience in a leadership role.
Associate's degree.
Demonstrated expertise in application security, secure SDLC, software assurance, DevSecOps, AI security, API security, cloud security, software supply chain security, security architecture, or cyber risk governance.
Demonstrated success establishing enterprise strategies, operating models, governance frameworks, technical standards, measurement strategies, and measurable risk-reduction outcomes.
Deep expertise in OWASP, NIST SSDF, NIST CSF, CWE, CVSS, ATT&CK, AI security frameworks, cloud-native architectures, APIs, containers, Kubernetes, Infrastructure-as-Code, and secure software governance.
Experience advising executives, risk committees, audit committees, regulators, senior technology leaders, and business stakeholders on application security strategy, risk, and investment decisions.
Experience leading programs supporting cloud transformation, digital modernization, mergers and acquisitions, developer security enablement, secure-by-design initiatives, software supply chain governance, and continuous security validation.
Ability to solve complex operational and organizational problems by leveraging resources inside and outside the department and persuading leaders to take action.

Nice To Haves

At least 10 years of progressive experience across application security, cybersecurity, technology risk, secure software development, software assurance, or related technology disciplines, including leadership of managers or multiple teams.
Published thought leadership, conference participation, industry engagement, regulatory interaction, peer group leadership, or recognized cybersecurity community expertise.
Advanced certification such as CISSP, CSSLP, CISM, CRISC, CCSP, OSWE, GWAPT, GWEB, GIAC, SABSA, AWS Security Specialty, Azure Security Engineer Expert, or equivalent recognized expertise.

Responsibilities

Define and evolve the enterprise Application Security vision, strategy, operating model, governance framework, control objectives, and multi-year roadmap.
Lead managers, professional staff, and related teams responsible for application security testing, secure SDLC, software assurance, DevSecOps, API security, AI security, and software supply chain risk.
Influence cybersecurity and technology investment decisions, resource allocation, security architecture standards, platform direction, risk acceptance, and remediation priorities.
Develop departmental plans, annual priorities, program objectives, staffing strategies, service models, and governance outcomes.
Lead strategy for critical applications, digital platforms, cloud environments, customer-facing services, mergers and acquisitions, and emerging technology initiatives.
Define and execute the enterprise vision for AI-enabled Application Security, integrating analytics, automation, Generative AI, and secure-by-design principles throughout the SDLC.
Lead strategic collaboration and information sharing across the financial services sector, including participation in FS-ISAC and other trusted industry forums.
Establish measurement strategies, KRIs, KPIs, exposure metrics, predictive analytics, executive dashboards, board-ready reporting, and regulatory evidence approaches.
Translate technical risk into executive-ready business narratives for risk and audit committees, senior leaders, regulators, and investment decision-makers.
Anticipate business, regulatory, technology, and threat landscape changes and recommend strategic improvements to products, processes, controls, services, and operating models.
Serve as senior escalation authority for significant application security incidents, strategic risk decisions, remediation disputes, software supply chain events, and high-risk exceptions.
Set priorities, allocate resources, develop leaders, and align multiple related teams with organizational objectives and annual plans.
Represent the Application Security function in executive forums, regulatory interactions, audit discussions, industry forums, peer groups, and strategic vendor engagements.
Champion secure-by-design, secure-by-default, developer enablement, automation, continuous validation, exposure management, and advanced security engineering practices.
Build organizational capability through talent development, leadership coaching, technical communities of practice, standards, reference architectures, and knowledge-sharing forums.