Description

• Define and lead the Application Security strategy for DCMS in-scope applications using tier-based control models.
• Identify control gaps and drive remediation and onboarding plans with application teams and stakeholders.
• Partner with Application Security Champions and engineering teams to ensure consistent adoption of required AppSec controls.
• nsure alignment with enterprise SDLC requirements and defect remediation expectations.
• AI Innovation for Application Security
• Identify and deliver AI and GenAI use cases that reduce manual AppSec effort and improve security coverage.
• Design and implement automated threat modeling using code, infrastructure-as-code, and application metadata.
• Develop adversarial testing capabilities for GenAI and LLM-based applications, including prompt injection and abuse scenarios.
• Lead initiatives for AI model scanning, integrity validation, and secure onboarding of models.
• Define protections for AI-specific risks including insecure prompt construction, tool misuse, and secrets exposure.

AppSec Modernization and Automation

• Drive modernization of AppSec controls through automation, rationalization, and platform integration.
• Build proofs-of-concept and pilot new security capabilities, scaling successful solutions into production.
• Influence simplification of AppSec processes to improve developer experience while maintaining strong risk controls.

Senior Lead Influence and Leadership

• Provide strategic guidance to senior leadership on Application Security priorities, risks, and investment decisions.
• Influence cross-functional teams without direct authority to achieve enterprise security outcomes.
• Research emerging threats and technologies and translate insights into actionable AppSec strategy.

Required Qualifications

• MUST HAVE BANKING EXPERIENCE
• 7+ years of Application Security or Information Security Engineering experience at enterprise scale.
• Deep expertise in SSDLC controls including threat modeling, secure design, SAST, SCA, DAST, and penetration testing.
• Proven ability to define security strategy and deliver outcomes through influence and technical leadership.

Desired Qualifications

• Experience securing GenAI and LLM-based applications, including adversarial testing and prompt-injection defenses.
• Experience designing AI-driven security automation or decisioning capabilities.
• Strong understanding of DevSecOps and CI/CD security integration.
• Experience working in highly regulated environments such as financial services.
• Relevant security certifications (CISSP, CSSP, CISM, or equivalent).

Required Skills

• 7+ years of Application Security or Information Security Engineering experience at enterprise scale.        
• Deep expertise in SSDLC controls including threat modeling, secure design, SAST, SCA, DAST, and penetration testing.
• Proven ability to define security strategy and deliver outcomes through influence and technical leadership.
• Experience securing GenAI and LLM-based applications, including adversarial testing and prompt-injection defenses.                                                                                                                               
• Experience designing AI-driven security automation or decisioning capabilities.                                                                                                                             
• Strong understanding of DevSecOps and CI/CD security integration.                                                                                                                            
• Experience working in highly regulated environments such as financial services.                                                                                                                         
• Relevant security certifications (CISSP, CSSP, CISM, or equivalent)

Key Skills

Education

Bachelor's degree