דרושים » אבטחת מידע וסייבר » Head of Application Security 24652

We are looking for an Senior/Staff Application Security Engineer who will ensure the security of our software by identifying and mitigating vulnerabilities, implementing best security practices, and collaborating with development teams. The ideal candidate will have a strong background in secure coding, threat modeling and building Secure SDLC.

What you will do
Build and maintain Application Security Posture Management (ASPM) at the Company scale.
Automate and support SAST, SCA tools, etc as part of CI/CD pipelines.
Improving SAST, secrets detection rules. Keeping false positive rate low.
Identify, analyze, and remediate application security vulnerabilities.
Collaborate with development teams to integrate security best practices into the software development lifecycle (SDLC).
Develop and maintain secure coding guidelines for development teams.
Conduct, run threat modeling and risk assessments for new and existing applications.
Provide development teams with instruments that facilitate security-related work like threat modelling, vulnerability detection, etc.
Stay updated on the latest security threats, vulnerabilities, and mitigation techniques.

We are seeking a highly skilled and hands-on Application Security Lead to take ownership of our product and infrastructure security. Reporting directly to the CISO with a dotted line to the CTO, you will act as the critical bridge between our Security and Engineering teams, driving a robust "security-first" culture.



While this role encompasses both application and infrastructure security, our primary focus is on the Application Security domain. You will lead our transition towards a mature DevSecOps organization, ensuring that security is seamlessly embedded into every phase of our SDLC without compromising delivery speed.

Key Responsibilities

Application Security & Secure Engineering

Secure SDLC Integration: Embed security practices throughout the entire SDLC, from initial design and planning to deployment and maintenance.
Threat Modeling & Architecture: Lead threat modeling (e.g., STRIDE) and architectural reviews for high-risk features like authentication, PII, and payments.
AppSec Tooling & Automation: Integrate and manage automated security scanning (SAST, SCA, DAST) within CI/CD pipelines to ensure code integrity seamlessly.
Mobile & API Security: Enforce least-privilege models for API configurations. Lead security initiatives specifically tailored to mobile environments (iOS/Android), protecting core mobility platform.
Offensive Security & Pentesting: Orchestrate internal red teaming and external penetration tests for web and mobile applications. Manage Vulnerability Disclosure Programs (VDP) / Bug Bounties.
Developer Empowerment & DevEx: Collaborate with developers to provide automated tools, coding guidelines, and frictionless guardrails for secure-by-design development, ensuring security acts as an enabler, not a blocker.
Incident & Vulnerability Management: Act as the technical escalation point for application security incidents, leading detection and recovery efforts, while prioritizing vulnerabilities across the product suite for timely remediation.
Cloud & Infrastructure Security

Cloud & Network Posture: Manage cloud security posture (CSPM) across AWS/GCP and oversee broad network security measures, including WAF, Bot management, and environment segmentation.
Pipeline & Secrets Management: Secure the CI/CD infrastructure against tampering and enforce robust secret management and secure repository controls across the organization.
Resilience & Recovery: Manage disaster recovery (DR) and business continuity planning for production environments.
Governance, Culture & Compliance

DevSecOps Strategy: Lead the strategic evolution of DevOps into a mature DevSecOps model, aligning with industry frameworks like OWASP SAMM and NIST SSDF.
Metrics & Measurement: Define and track key security metrics (e.g., MTTR, vulnerability density) to measure and improve program effectiveness.
Security Champions: Build and mentor a Security Champions program within R&D to scale security knowledge and foster a grassroots culture.
Compliance & Privacy: Ensure continuous compliance with PCI-DSS, ISO27001, and GDPR, championing privacy-by-design principles across all user data and R&D operations.

we are looking for a Senior Product Security Architect.
As a Senior Product Security Architect, you will join a highly technical, fast-moving Product Security team to advance and secure Axonius's platform and its modern AI-driven capabilities. Operating in an environment with deep R&D collaboration and a hybrid schedule, you will own the development lifecycle's security strategy, ensuring modern cloud and distributed systems are engineered safely by design. This role directly supports core development teams across Israel and Portugal, ensuring robust posture alignment from initial planning through deployment.
Responsibilities
Collaborate with R&D teams to identify, prioritize, and drive security requirements and mitigation strategies throughout the development lifecycle.
Conduct architecture, design, and threat modeling security reviews for web, cloud (AWS), and distributed systems.
Produce explicit, actionable security architecture documents, design specifications, and technical guidelines for engineering.
Lead incident response efforts during active product cyber security events, driving cross-functional remediation across engineering teams.

we are looking for a Product Security Architect- 9-month temp position.
As a Product Security Architect, you will join a highly technical, fast-moving Product Security team to advance and secure Axonius's platform and its modern AI-driven capabilities. Operating in an environment with deep R&D collaboration and a hybrid schedule, you will own the development lifecycle's security strategy, ensuring modern cloud and distributed systems are engineered safely by design. This role directly supports core development teams across Israel and Portugal, ensuring robust posture alignment from initial planning through deployment.
Responsibilities:
Collaborate with R&D teams to identify, prioritize, and drive security requirements and mitigation strategies throughout the development lifecycle.
Conduct architecture, design, and threat modeling security reviews for web, cloud (AWS), and distributed systems.
Produce explicit, actionable security architecture documents, design specifications, and technical guidelines for engineering.
Lead incident response efforts during active product cyber security events, driving cross-functional remediation across engineering teams.

We're looking for a Security Operations (SecOps) specialist to take ownership of our security infrastructure and operations as we scale. In this hands-on, high-impact role, youll play a crucial role in managing the infrastructure, services and service providers that help keep secure from outside attacks and insider threats, along with managing our information compliance programs.
Responsibilities:
Support and lead our security programs, both internal and with 3rd party vendors.
Lead incident response simulations and continuous vulnerability remediation efforts, optimizing our observability and alerting frameworks.
Support the design and maintenance of resilient, scalable cloud infrastructure, ensuring security is baked into the foundation.
Work closely with company leadership to ensure adoption of security best practices.
Work closely with R&D teams to help them shift security testing left into the early phases of development.
Monitor, detect, and respond to security alerts and infrastructure anomalies, optimizing our logging, tracing, and alerting frameworks.
Conduct regular reviews of security tools and infrastructure such as endpoint security, malware detection, firewall logs, and the like.
Collaborate with our CISO to implement and automate controls supporting fintech/insurtech compliance and data privacy standards (PII protection, SOC2).

We are seeking an experienced Security Engineering Lead to join the Cyber Security organization, reporting to the Corporate Security Engineering Manager under the CISO.

This is a senior technical lead role focusing on engineering and execution without direct people management responsibilities. This role combines hands-on security engineering to deliver end-to-end protection across corporate, cloud, and SaaS environments. You will not only define strategy and standards - you will build, configure, tune, and operate the technical controls that enforce them.

You will be responsible for implementing, managing, integrating and maintaining security systems across the organizations IT landscape. The role requires deep technical proficiency in multiple platforms and tools, combined with the ability to collaborate with Security, IT, Engineering, Product, GRC and other business units to reduce risks and embed strong security practices.

Your responsibilities will include:

Engineer, deploy, and continuously tune systems such as Identity & Access, Threat Detection & Response, Cloud & Network Security.
Define, enforce and maintain security policies & configurations across endpoints, email, SaaS, network, and cloud platforms.
Design and implement solutions to gain continuous visibility into systems and processes, sensitive data, data flows, misconfigurations, and exposure risks across cloud and multi-cloud environments.
Monitor, triage, and investigate security alerts and risks, collaborating with Security, IT, Network teams on escalation and remediation.
Conduct risk assessments and identify gaps in security controls across systems, pipelines, and business processes.
Support compliance and regulatory requirements (e.g., GDPR, ISO 27001, SOC 2) related to security and privacy.
Collaborate with Engineering, IT, Product, and GRC teams to embed security controls into systems, and workflows.
Maintain documentation, runbooks, and guidelines for operations, security posture management, and security practices.

we are looking for a Head of Security Reliability to establish and lead the Security Reliability pillar. Reporting directly to the CISO, this leader will be accountable for the ongoing effectiveness, resilience, and operational maturity of security products after implementation.

The role ensures that security platforms remain properly configured, maintained, integrated, monitored, adopted, and optimized to deliver measurable risk reduction. It also owns Third-Party Risk Management (TPRM) program and the security-review process for new products, services, and technologies introduced across the company.

This is a hands-on leadership position for someone who combines security expertise, operational discipline, vendor-management experience, and a strong product mindset. The role partners closely with Security, IT, Engineering, Product, Procurement, Legal, Privacy, Compliance, and business stakeholders.

Key responsibilities

Security product reliability and lifecycle ownership

Own security products and platforms after implementation, from operational handover through optimization, renewal, replacement, or retirement.
Ensure security tools are correctly configured, maintained, integrated, monitored, and aligned with Nebius's risk profile and technical environment.
Define ownership, service levels, operating procedures, support models, and escalation paths for every security platform.
Monitor platform availability, data quality, control coverage, integration health, licensing, capacity, and performance.
Establish disciplined processes for upgrades, configuration changes, testing, exception management, and end-of-life planning.
Continuously assess whether security products deliver their intended outcomes, and improve utilization, coverage, automation, and return on investment.
Reduce overlapping capabilities, configuration drift, operational gaps, and underused tooling across the security stack.
Manage vendor performance, technical escalations, product-roadmap discussions, renewals, and service reviews.
Ensure newly implemented security products transition into operations with clear documentation, ownership, monitoring, and success criteria.
Security configuration and control assurance

Define and maintain secure configuration baselines for security platforms.
Establish continuous control-health monitoring to identify disabled, degraded, misconfigured, or incomplete controls.
Validate that integrations and telemetry remain complete, accurate, and reliable as environment evolves.
Coordinate remediation of control gaps with Security, IT, Engineering, and platform owners.
Maintain evidence demonstrating the operational effectiveness of security controls for audits, certifications, and customer-assurance activities.

We are seeking a seasoned security leader to manage a high-caliber research team focused on the security of Identity, SaaS, and Cloud ecosystems. In this role, you will provide technical mentorship and strategic vision, guiding research into service risk profiling and adversarial TTPs analysis. You will be the bridge between cutting-edge research and product innovation, ensuring our findings translate into high-impact security outcomes to stay ahead of modern adversaries.
Key Responsibilities
Define the research roadmap for Identity, SaaS, and Cloud risks, ensuring the team's outputs align with the evolving threat landscape and company goals.
Lead and grow a diverse team of security researchers, providing the technical guidance and career development necessary to maintain a world-class research organization.
Leverage your experience in a product-focused environment to ensure research outcomes directly influence service security strategies and customer-facing solutions.
Oversee the execution of high-fidelity attack simulations and TTP deconstruction, ensuring the 'how-to' of secure service usage is clearly defined and actionable.
Partner with Engineering, Product Management, and Threat Intel teams to transform raw research into robust mitigation strategies and resilient service blueprints.
Represent the team's research internally and externally, positioning the organization as a premier authority on Identity-centric and Cloud security.

We are seeking a seasoned security leader to manage a high-caliber research team focused on the security of Identity, SaaS, and Cloud ecosystems. In this role, you will provide technical mentorship and strategic vision, guiding research into service risk profiling and adversarial TTPs analysis. You will be the bridge between cutting-edge research and product innovation, ensuring our findings translate into high-impact security outcomes to stay ahead of modern adversaries.
Key Responsibilities:
Define the research roadmap for Identity, SaaS, and Cloud risks, ensuring the team's outputs align with the evolving threat landscape and company goals.
Lead and grow a diverse team of security researchers, providing the technical guidance and career development necessary to maintain a world-class research organization.
Leverage your experience in a product-focused environment to ensure research outcomes directly influence service security strategies and customer-facing solutions.
Oversee the execution of high-fidelity attack simulations and TTP deconstruction, ensuring the 'how-to' of secure service usage is clearly defined and actionable.
Partner with Engineering, Product Management, and Threat Intel teams to transform raw research into robust mitigation strategies and resilient service blueprints.
Represent the team's research internally and externally, positioning the organization as a premier authority on Identity-centric and Cloud security.

You will have a strong technical understanding of the nature of identified vulnerabilities, be able to clearly express the risk posed by these issues, and be able to evaluate the merits of proposed solutions. You will have a good understanding of security risk and be able to prioritize work accordingly.

While this role requires technical security proficiency, you will also leverage your people skills to partner with development, release, and other security teams at Cisco to ensure that we address vulnerabilities promptly, document our security posture clearly, and are following industry best practices in our products. You will advocate for security best practices across your interactions with your colleagues.