Practice Director - Application Security

AHEAD

1d•$250,000 - $350,000

About The Position

The Practice Director leads the growth, performance, and ongoing development of AHEAD’s Application Security practice. The role builds executive client relationships, creates and advances sales opportunities, shapes services and go-to-market strategy, and develops a high-performing team. It partners with AHEAD sales teams and other practices to deliver integrated security solutions addressing business and technology risk. The position is weighted approximately 70% toward sales and practice management and 30% toward delivery leadership. It requires deep expertise in application security, DevSecOps, cloud-native security, and secure software delivery to advise clients, differentiate AHEAD’s offerings, and ensure successful outcomes on selected strategic engagements. The Director is responsible for practice growth strategy, client and sales opportunity development, service portfolio and go-to-market leadership, partnerships, team development, resource planning, and practice operations. The role also provides executive oversight for selected strategic engagements, guides client strategy and technical work, monitors delivery quality and risk, and maintains a selective client-delivery role to inform the practice portfolio.

Requirements

15+ years of consulting or commensurate professional experience in information security, application security, cloud security, or a related field.
Significant leadership experience in a practice, program, business development, or consulting leadership role, including developing people and influencing business outcomes.
Demonstrated success building client relationships and growing consulting opportunities, including leading discovery, solution shaping, scoping, proposal development, and executive presentations.
Experience developing or scaling professional services, security capabilities, or go-to-market offerings.
Demonstrated experience establishing, assessing, or maturing application security and DevSecOps programs.
Strong understanding of application and API security concepts, modern software delivery, cloud-native architectures, and the tools and practices used to secure them.
Ability to lead complex client engagements, manage executive stakeholders, and guide teams through ambiguity, competing priorities, and delivery risks.
Excellent written, verbal, presentation, facilitation, and relationship-building skills; ability to communicate with technical practitioners and executive audiences.
Strong business acumen, strategic judgment, and ability to connect security investments to client objectives and measurable outcomes.
Current expertise in application security program strategy and maturity, secure SDLC, DevSecOps, and secure coding practices.
Expertise in application and API threat modeling, architecture and design review, and risk-based vulnerability prioritization.
Knowledge of Application Security Posture Management and tools such as SAST, DAST, SCA, and secrets detection for prioritizing and coordinating remediation.
Knowledge of API security, including REST and GraphQL risks, authentication and authorization patterns, and relevant OWASP guidance.
Knowledge of CI/CD and software supply-chain security, including dependency and open-source risk, SBOM practices, artifact integrity, and provenance.
Knowledge of cloud-native application security and the relationships among code, infrastructure-as-code, containers, Kubernetes, runtime context, and cloud posture.
Knowledge of application security frameworks and maturity models such as OWASP SAMM and DSOMM, and ability to map technical controls to governance and compliance needs.
Familiarity with application security platforms and the broader security ecosystem, and ability to evaluate technology in the context of client outcomes rather than a single vendor.

Nice To Haves

Undergraduate degree in Computer Science, Business Management, or a related field is preferred but not required.
Industry-recognized security certifications are preferred, such as CISSP, CCSP, CSSLP, or relevant GIAC certifications.

Responsibilities

Build and execute the Application Security practice growth strategy, translating market needs and AHEAD priorities into a focused service portfolio and go-to-market plans.
Develop trusted relationships with client executives and technology leaders, identifying business priorities, security challenges, and opportunities to expand AHEAD’s impact.
Partner with sales specialists to qualify, shape, and advance opportunities from discovery through proposal, negotiation, and transition to delivery.
Lead client discovery, visioning, and solution-design sessions, communicating proposed services’ value, approach, scope, outcomes, assumptions, and investment.
Own or contribute to opportunity plans, pipeline development, forecasts, and practice growth objectives in coordination with AHEAD sales and practice leadership.
Create, refine, and commercialize differentiated Application Security offerings, including AI Application Security and AI-DLC, program assessments and roadmaps, secure SDLC and DevSecOps enablement, application and API security, threat modeling, ASPM, and software supply-chain security.
Drive new partnerships with industry-leading AI development and security technology partners.
Identify opportunities to combine Application Security services with cloud, infrastructure, data, AI, and other AHEAD capabilities.
Guide service positioning, packaging, repeatability, and supporting sales materials, keeping offerings aligned with client needs and market and technology trends.
Build and develop the practice team through hiring, talent development, coaching, mentoring, and succession planning; foster collaboration across delivery and sales teams.
Direct practice capacity and resource planning with delivery leaders, balancing team capability, client demand, utilization, and quality.
Establish accountability, continuous improvement, knowledge sharing, and strong client service; support consistent operating practices and financial performance.
Represent AHEAD through executive briefings, industry events, partner and client engagements, and thought leadership.
Provide executive oversight and delivery leadership for selected strategic or complex Application Security engagements, ensuring agreed scope, quality, schedule, and business outcomes.
Lead or advise client strategy, roadmap, architecture, and planning workshops covering application security, secure software delivery, cloud-native applications, APIs, and risk prioritization.
Guide teams delivering application security assessments and maturity improvements, secure SDLC controls, threat modeling, DevSecOps enablement, application and API security reviews, and remediation planning.
Ensure recommendations are practical and risk-based, translating technical findings into prioritized actions and clear business implications.
Monitor engagement health, milestones, dependencies, risks, and client expectations; intervene to resolve issues and maintain delivery quality.
Review key deliverables and executive presentations, and coach engagement leaders and practitioners in client communication and delivery excellence.
Maintain a selective client-delivery role to stay close to client needs, validate service approaches, and bring delivery insight back into the practice portfolio.