Global Application Security Lead

Lockton•Overland Park, KS

3d•Onsite

About The Position

The Global Application Security Lead owns day-to-day execution of the application security and DevSecOps program across business units and regions. This hands-on technical leadership role manages the application security engineering team and is accountable for delivery against the strategy set by the Global Enterprise Security Architect, technical quality of the program, and team performance and development. The role establishes and operates security controls throughout the software development lifecycle, from secure design and threat modeling through analysis, testing, secrets management, and production hardening. The Lead manages the AppSec tooling estate, performs and directs application-level testing, establishes secure SDLC standards, and partners with engineering teams to integrate controls into delivery workflows. The position is based in Kansas City, Missouri, with in-office work three days per week and periodic travel to regional technology hubs. It supports engineering teams across US, UK, MENA, and APAC time zones, manages two application security engineers, and provides technical direction to LGCC offshore engineering resources. The Global Enterprise Security Architect is responsible for strategy, budget, and executive reporting; this role owns program delivery and operational execution.

Requirements

10 years of experience in application security, product security, or secure software engineering, including 2 years in a lead or management capacity.
Demonstrated people management experience, including hiring, performance management, and career development of security or engineering staff.
Experience leading distributed teams across multiple time zones, including offshore engineering resources.
Hands-on experience operating SAST, SCA, DAST, and secrets scanning tools at enterprise scale, including pipeline integration and rule tuning.
Ability to perform manual secure code review and application penetration testing, with working command of Burp Suite Pro or equivalent.
Working knowledge of at least two of .NET, Java, Python, JavaScript/TypeScript, and Go.
Practical experience securing CI/CD pipelines and cloud-native workloads.
Fluency with OWASP Top 10, OWASP ASVS, OWASP SAMM or BSIMM, and CWE.
Experience supporting regulatory or certification audits in a regulated industry.
Ability to write clear, structured technical findings and standards documentation for engineering and audit audiences.

Nice To Haves

Financial services, insurance, or other regulated industry experience.
Experience with software supply-chain security, SBOM generation, and dependency provenance controls.
Experience defining controls for AI-assisted development tooling and AI-generated code review.
Certifications such as OSWE, OSCP, GWAPT, CSSLP, or CISSP.
Experience with Azure and Azure DevOps or GitHub Actions.

Responsibilities

Execute the phased application security roadmap, owning milestone delivery, dependencies, and status reporting.
Operate the tiered application governance model, including risk-tiering intake, control expectations by tier, and periodic application portfolio re-tiering.
Define and maintain secure SDLC standards, secure coding guidelines, and control gates throughout the development pipeline.
Track and report AppSec operational metrics, including scan coverage, finding volume by severity, mean time to remediate, SLA adherence, and exception backlog.
Maintain the application security exception and risk acceptance register, escalating material risk to the Global Enterprise Security Architect.
Own the AppSec tooling estate end to end, including SAST, SCA, DAST, secrets scanning, container scanning, and IaC scanning; manage deployment, tuning, rules, and pipeline integration.
Lead tooling proof-of-concept exercises, set evaluation criteria, conduct technical bake-offs, and prepare recommendation documentation for architecture review.
Perform and direct internal application penetration testing, manual code review, and threat modeling for Tier 1 and high-risk applications.
Triage findings, validate exploitability, remove false positives, and drive remediation with engineering teams.
Manage third-party penetration test scoping, vendor coordination, finding validation, and retest closure.
Maintain and enforce guardrails for AI-assisted development, including approved AI coding tools, agentic tooling, MCP server usage, and dependency provenance controls addressing supply-chain and slopsquatting risk.
Build, lead, and develop the application security engineering team, including onshore staff and LGCC offshore engineering resources.
Own hiring for the function, including role definition, interview loop design, candidate assessment, and onboarding.
Conduct performance reviews, set individual objectives, and manage performance concerns in partnership with HR.
Define career paths, technical skill matrices, and individual development plans for application security engineers.
Allocate work and manage team capacity against the program roadmap and inbound intake demand.
Mentor the team on secure code review, exploitation techniques, tooling operation, and finding write-up quality.
Provide input to headcount planning and offshore resourcing requests for review by the Global Enterprise Security Architect.
Define runbooks, playbooks, and repeatable procedures to ensure AppSec operations do not depend on individual knowledge.
Coordinate day-to-day work and handoffs across US, UK, MENA, and APAC time zones.
Partner with Engineering, DevOps, Platform, and Product teams to embed controls into delivery workflows with minimal friction to release velocity.
Act as the first-line technical escalation point for application security findings, remediation disputes, and release-blocking decisions; escalate unresolved risk decisions.
Support GRC and audit teams with evidence, control narratives, and testing artifacts for NYDFS 23 NYCRR 500, HITRUST, GDPR, and DORA obligations.
Support incident response for software-related incidents, including vulnerability triage, exploit analysis, and root-cause contribution.
Translate technical findings into business impact for application owners and non-technical stakeholders.
Operate the Security Champions program, including champion selection, enablement content, and recurring working sessions.
Deliver secure coding training and targeted enablement based on observed codebase defect patterns.
Drive shift-left adoption so security defects are found and fixed during development rather than at release gates.