Director, Application & Product Security
About The Position
We are seeking a Director, Application & Product Security to join our Information Security organization. You will lead Grainger’s Application & Product Security program by establishing the strategy, governance, and security practices that enable the secure design, development, and delivery of applications, APIs, and digital products. You will partner with Engineering, Product Management, Platform Engineering, Enterprise Architecture, and Security Architecture and Security Engineering to integrate security into software delivery processes while enabling engineering teams to deliver secure, resilient, and innovative solutions. The Director, Application & Product Security requires deep experience in application security, product security, secure software development practices, and modern technology platforms. The successful candidate understands how engineering organizations build and deliver software and can effectively partner with engineering leaders to integrate security throughout the software development lifecycle. This leader is a trusted advisor who enables secure innovation through collaboration, influence, and technical leadership rather than direct ownership of software development. You will report to the Chief Information Security Officer (CISO). This is a hybrid role based in downtown Chicago, with weekly presence at our Mart location. There is a very strong preference for a candidate who resides in Chicago or is willing to relocate here.
Requirements
- Bachelor’s Degree in Computer Science, Cybersecurity, Information Systems, Software Engineering, or related field required.
- 10+ years of progressive experience in application security, product security, cybersecurity, software architecture, or related technology disciplines required.
- 5+ years of leadership experience building and leading technical security teams required.
- Experience implementing Secure Software Development Lifecycle (SSDLC) practices within large engineering organizations required.
- Demonstrated understanding of modern software engineering practices including Agile, DevOps, CI/CD, cloud-native development, APIs, microservices, containers, and Infrastructure as Code required.
- Experience partnering with software engineering and product organizations to embed security throughout the software development lifecycle required.
- Experience with application security practices including threat modeling, application security testing, software composition analysis, API security, software supply chain security, and vulnerability management required.
- Strong understanding of secure software design principles, application security risks, OWASP guidance, and secure-by-design practices required.
- Experience partnering with senior technology leaders and influencing engineering organizations through technical leadership, collaboration, and trusted advisory relationships required.
- Strong written, verbal, and executive communication skills with the ability to communicate complex technical concepts and cyber risk to senior leadership required.
Nice To Haves
- Professional certifications such as CISSP, CSSLP, GIAC, or equivalent technical credentials preferred.
Responsibilities
- Lead Grainger’s enterprise Application & Product Security strategy in alignment with the Information Security strategy and business objectives.
- Build, develop, and lead a high-performing Application & Product Security organization.
- Establish enterprise standards and governance for the Secure Software Development Lifecycle (SSDLC), secure-by-design, and secure-by-default engineering practices.
- Partner with Engineering, Product Management, Platform Engineering, Enterprise Architecture, and Security Architecture and Security Engineering to establish secure development standards, integrate security into engineering workflows, and improve the security posture of Grainger’s applications and digital products.
- Lead threat modeling, secure design reviews, and application and product security assessments for critical business initiatives.
- Establish and mature capabilities for application security testing, software composition analysis, API security, software supply chain security, and DevSecOps practices.
- Define security requirements and reference architectures for applications, APIs, cloud-native technologies, and emerging software architectures.
- Partner with Security Architecture and Security Engineering to establish secure development practices for AI-enabled applications, AI-assisted software development, and emerging software technologies.
- Build trusted relationships with engineering organizations and serve as a strategic advisor on secure software development and product security.
- Establish developer enablement and Security Champion programs that improve secure coding practices and strengthen security ownership across engineering teams.
- Define application and product security metrics, key risk indicators, and executive reporting to measure program maturity, adoption, and business outcomes.
- Monitor application and product security risks and work with engineering teams to prioritize remediation based on business risk.
- Evaluate emerging application security technologies and industry best practices to continuously improve Grainger’s security capabilities while supporting engineering velocity.
- Develop, mentor, and retain technical security talent while fostering a culture of innovation, accountability, collaboration, and continuous improvement.
- Represent the Application & Product Security function in enterprise architecture reviews, strategic technology initiatives, and executive governance forums.
Benefits
- Medical, dental, vision, and life insurance plans with coverage starting on day one of employment
- 6 free sessions each year with a licensed therapist to support your emotional wellbeing
- 18 paid time off (PTO) days annually for full-time employees (accrual prorated based on employment start date)
- 6 company holidays per year
- 6% company contribution to a 401(k) Retirement Savings Plan each pay period, no employee contribution required.
- Employee discounts
- Tuition reimbursement
- Student loan refinancing
- Free access to financial counseling, education, and tools
- Maternity support programs
- Nursing benefits
- Up to 14 weeks paid leave for birth parents
- Up to 4 weeks paid leave for non-birth parents
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Director
