Application Security Director

Summary:

The Application Security Director provides leadership to managers and professional staff responsible for enterprise application security, secure development, software assurance, software supply chain security, cloud-native security, API security, and emerging technology risk. This role is accountable for the performance and results of multiple related teams, develops departmental plans and priorities, and serves as an industry expert and strategic advisor for enterprise application security risk management.

Duties and Responsibilities:

• Define and evolve the enterprise Application Security vision, strategy, operating model, governance framework, control objectives, and multi-year roadmap aligned to business, technology, and cybersecurity objectives.
• Provide leadership across managers, professional staff, and related teams responsible for application security testing, secure SDLC, software assurance, Dev Sec Ops , API security, AI security, and software supply chain risk.
• Shape cybersecurity and technology strategy by influencing investment decisions, resource allocation, security architecture standards, platform direction, risk acceptance, and remediation priorities.
• Develop departmental plans, annual priorities, program objectives, staffing strategies, service models, and governance outcomes that improve application security maturity and enterprise resilience.
• Lead strategy for the organization’s most critical applications, digital platforms, cloud environments, customer-facing services, mergers and acquisitions, and emerging technology initiatives.
• Define and execute the enterprise vision for AI-enabled Application Security, integrating advanced analytics, automation, Generative AI, and secure-by-design principles throughout the SDLC to proactively identify, prioritize, report, remediate, and validate application security exposures while enabling secure innovation and reducing organizational risk.
• Lead strategic collaboration and information sharing across the financial services sector, serving as an active member of FS-ISAC and other trusted industry forums to exchange application security intelligence, secure development practices, software supply chain risk insights, and emerging threat trends that strengthen organizational resilience and support collective cyber defense.

• Establish enterprise measurement strategy, KRIs, KPIs, exposure metrics, predictive analytics, executive dashboards, board-ready reporting, and regulatory evidence approaches for application security risk.
• Translate complex technical risk into executive-ready business narratives that support risk committees, audit committees, senior leaders, regulatory discussions, and investment decisions.
• Anticipate business, regulatory, technology, and threat landscape changes and recommend strategic improvements to products, processes, controls, services, and operating models.
• Serve as senior escalation authority for significant application security incidents, strategic risk decisions, complex remediation disputes, software supply chain events, and high-risk exceptions.

• Lead multiple related teams by setting priorities, allocating resources, developing leaders, and aligning work to organizational objectives and annual plans.
• Represent the Application Security function in executive forums, regulatory interactions, audit discussions, industry forums, peer groups, and strategic vendor engagements.
• Champion secure-by-design, secure-by-default, developer enablement, automation, continuous validation, exposure management, and advanced security engineering practices across the enterprise.
• Build organizational capability through talent development, leadership coaching, technical communities of practice, standards, reference architectures, and knowledge-sharing forums.

Basic Qualifications:

• Min 6 yrs of experience in Information Security, preferably in the Operations domain
• Min 4 years of Application Development (new)
• Min 4 yrs of experience in a Leadership role
• Associate's Degree

Preferred Qualifications:

• 10 or more years of progressive experience across application security, cybersecurity, technology risk, secure software development, software assurance, or related technology disciplines, including leadership of managers or multiple teams.
• Recognized industry expertise in application security, secure SDLC, software…