Produce executive-ready metrics and reporting that connect AppSec activity to business risk reduction.
Qualifications
Required
7+ years in application security, product security, or security engineering, with at least 3 years in environments with multiple independent business units, brands, or product lines.
Hands-on experience deploying and operating modern AppSec tooling such as Semgrep, Snyk, Checkmarx, Veracode, Apiiro, Ox Security, or GitHub Advanced Security.
Working code-level proficiency in at least three commonly-used languages including Python, JavaScript/TypeScript, Java, C#, or Go, sufficient to read, review, and triage findings.
Strong scripting and automation skills in Python or equivalent; comfortable building integrations against REST APIs and operating in CI/CD environments such as GitHub Actions, GitLab CI, Jenkins, or Azure DevOps.
Demonstrated ability to influence engineering organizations without direct authority — negotiating standards, driving adoption, and partnering with development leaders.
Practical understanding of OWASP Top 10, threat modeling methodologies such as STRIDE or PASTA, and modern attack patterns including supply chain risks.
Preferred
Experience integrating LLM-based tooling into security workflows such as alert triage, finding summarization, and remediation guidance generation.
Familiarity with one or more compliance frameworks including HITRUST, HIPAA, NIST AI RMF, or SOC 2.
Prior experience working in a regulated or healthcare-adjacent environment.
Cloud security depth in at least one major provider including AWS, Azure, or GCP.
Public contribution to the AppSec community through OSS, conference talks, published research, or detection/rule contributions.
