Director Application Security

Western Union•Austin, TX

9d•$200,000 - $215,000•Hybrid

About The Position

The Director Application Security will lead the strategy, development, and execution of the organization’s Application Security program. Reporting to the Vice President of Security Operations, this leader will mature and optimize application security capabilities across the software development lifecycle, embed secure-by-design principles into engineering practices, and enable rapid delivery of innovative products. The Director will partner with Engineering, Product Management, Architecture, DevOps, Cloud Engineering, and Security Operations to integrate security throughout software development. The role focuses on building or transforming application security programs in complex technology organizations and influencing engineering culture through collaboration rather than gatekeeping. The position includes leading a high-performing Application Security team, developing trusted engineering partnerships, managing security technologies and vendors, and establishing metrics and operational objectives. The role is hybrid. The stated U.S. base salary range is $200,000–$215,000 per year, with total on-target compensation also including a variable target incentive aligned with individual and company performance.

Requirements

Bachelor's degree in Computer Science, Cybersecurity, Engineering, or a related field.
At least 10 years of progressive experience in Application Security, Software Security, Product Security, Secure Engineering, or related cybersecurity disciplines.
At least 5 years leading Application Security teams.
Demonstrated success building, transforming, or significantly maturing Application Security programs within enterprise organizations.
Experience partnering closely with software engineering organizations in Agile and DevSecOps environments.
Strong understanding of Secure Software Development Lifecycle (SSDLC), OWASP Top 10, secure coding principles, threat modeling, modern authentication protocols, API security, cloud-native application security, container security, CI/CD security, DevSecOps, software supply chain security, governance and secure use of AI-assisted software development (“vibe coding”), and application vulnerability management.
At least one certification or comparable alternative: CISSP, CSSLP, GIAC Secure Software Programmer (GSSP), or GIAC Cloud Security Automation (GCSA).

Nice To Haves

Advanced degree preferred.

Responsibilities

Develop and execute an enterprise Application Security strategy aligned with business and technology objectives.
Build and mature a scalable Application Security program that supports modern software development practices.
Define a long-term roadmap for secure software development across cloud, web, mobile, APIs, and emerging technologies.
Establish secure-by-design principles and integrate them throughout the Software Development Life Cycle (SDLC).
Lead implementation and continuous improvement of a Secure Software Development Lifecycle (SSDLC).
Develop application development security standards and requirements.
Partner with engineering teams to integrate security early in CI/CD pipelines and promote developer-friendly practices that minimize friction.
Oversee application security testing, including SAST, DAST, SCA, IAST, API security testing, container security, IaC security, secure code reviews, and penetration testing coordination.
Partner with DevOps teams to embed automated security controls into CI/CD pipelines, improve security testing and vulnerability-management automation, streamline workflows, and measure security effectiveness while enabling engineering velocity.
Operationalize Continuous Threat & Exposure Management (CTEM) across critical applications and business services.
Define CTEM scope for critical business services, crown-jewel applications, sensitive data, material APIs, and externally exposed assets.
Consolidate exposure signals from application testing, attack-surface management, cloud security, vulnerability management, penetration testing, bug bounty, and threat intelligence.
Establish a common exposure taxonomy and risk model incorporating exploitability, reachability, business criticality, threat activity, and compensating controls.
Maintain an evidence-backed view of application exposure rather than relying primarily on scanner severity.
Provide application security guidance for cloud-native applications, microservices, APIs, containers, Kubernetes, serverless architectures, AI and machine learning applications, and third-party integrations.
Build trusted relationships with engineering leadership and champion security as an engineering quality function.
Develop security champions programs across engineering organizations.
Lead, mentor, and develop a high-performing Application Security team.
Establish performance metrics and operational objectives.
Manage vendor relationships and application security technologies.
Support hiring and organizational growth as the program matures.
Mentor developers on secure coding practices and emerging threats.
Complete a comprehensive assessment of Application Security maturity within the first 12–18 months.
Develop and execute a multi-year Application Security transformation roadmap within the first 12–18 months.
Integrate security into CI/CD pipelines across major engineering organizations and implement risk-based application security metrics and executive dashboards.
Reduce application vulnerability remediation times while improving engineering satisfaction, and standardize threat modeling, secure code review, and security testing practices.
Improve software security posture measurably without negatively affecting developer productivity.