Global Application Security Lead

The Global Application Security Lead owns the day-to-day execution of the application security and DevSecOps program across all business units and regions. The role is responsible for the security controls embedded in the software development lifecycle, from secure design and threat modeling through static and composition analysis, dynamic testing, secrets management, and production hardening.

This is a hands-on technical leadership role with people management responsibility. The Lead manages the application security engineering team, sets the working standards that engineering teams follow, runs the AppSec tooling estate, and performs and directs application-level testing. Strategy, budget, and executive reporting sit with the Global Enterprise Security Architect; the Lead is accountable for delivery against that strategy, for the technical quality of the program, and for the performance and development of the team.

Position Details
Reports To\: Global Enterprise Security Architect, Security Architecture and Engineering (SA&E)
Location\: Kansas City, MO. In-office three days per week.
Travel\: Periodic travel to regional technology hubs.
Coverage\: Supports engineering teams across US, UK, MENA, and APAC time zones.
Direct Reports\: 2 application security engineers, plus technical direction of LGCC offshore engineering resources.

Core Responsibilities
Program Delivery
• Execute the phased application security roadmap set by the Global Enterprise Security Architect, owning milestone delivery, dependencies, and status reporting
• Operate the tiered application governance model (T1/T2/T3), including risk tiering intake, control expectations per tier, and periodic re-tiering of the application portfolio
• Define and maintain secure SDLC standards, secure coding guidelines, and control gates at each stage of the development pipeline
• Track and report AppSec operational metrics\: scan coverage, finding volume by severity, mean time to remediate, SLA adherence, and exception backlog
• Maintain the application security exception and risk acceptance register, escalating material risk to the Global Enterprise Security Architect

Technical Ownership
• Own the AppSec tooling estate end to end\: SAST, SCA, DAST, secrets scanning, and container and IaC scanning, including deployment, tuning, rule management, and pipeline integration
• Lead tooling proof of concept exercises, define evaluation criteria, run technical bake-offs, and produce recommendation documentation for architecture review
• Perform and direct internal application penetration testing, manual code review, and threat modeling on Tier 1 and high-risk applications
• Triage findings across all sources, validate exploitability, remove false positives, and drive remediation with owning engineering teams
• Manage third-party penetration test scoping, vendor coordination, finding validation, and retest closure
• Maintain and enforce guardrails for AI-assisted development, including approved AI coding tools, agentic tooling, MCP server usage, and dependency provenance controls addressing supply chain and slopsquatting risk

Team Leadership and People Management
• Build, lead, and develop the application security engineering team, including onshore staff and LGCC offshore engineering resources
• Own hiring for the function\: role definition, interview loop design, candidate assessment, and onboarding
• Conduct performance reviews, set individual objectives, and manage performance concerns in partnership with HR
• Define career paths, technical skill matrices, and individual development plans for application security engineers
• Allocate work and manage team capacity against the program roadmap and inbound intake demand
• Provide technical mentorship on secure code review, exploitation technique, tooling operation, and finding write-up quality
• Provide input to headcount planning and offshore resourcing requests for review by the Global Enterprise Security Architect
• Define runbooks, playbooks, and repeatable procedures so that AppSec operations are not dependent on individual knowledge
• Manage day-to-day coordination and handoffs across US, UK, MENA, and APAC time zones

Cross-Functional Partnership
• Partner with Engineering, DevOps, Platform, and Product teams to embed controls into delivery workflows with minimal friction to release velocity
• Act as first-line technical escalation for application security findings, remediation disputes, and release blocking decisions, escalating unresolved risk decisions upward
• Support GRC and audit teams with evidence, control narratives, and testing artifacts for NYDFS 23 NYCRR 500, HITRUST, GDPR, and DORA obligations
• Support incident response for software-related incidents, including vulnerability triage, exploit analysis, and root cause contribution
• Translate technical findings into business impact for application owners and non-technical stakeholders

Security Champions and Culture
• Operate the Security Champions program within engineering teams, including champion selection, enablement content, and recurring working sessions
• Deliver secure coding training and targeted enablement based on observed defect patterns in the codebase
• Drive shift-left adoption so that security defects are found and fixed in development rather than at release gates