Product Security Team Leader

Responsibilities: 

• Lead and develop a high-performing product security team, setting priorities, standards, and measurable goals. 

• Define and execute the team’s roadmap in partnership with R&D, architecture, security champions, and business stakeholders. 

• Drive SSDLC practices, including threat modeling, secure design reviews, security requirements, code and architecture reviews, penetration testing, and vulnerability remediation. 

• Assess and advise on the security of web, mobile, API, microservices, Kubernetes, and cloud-native products. 

• Oversee penetration testing, vulnerability management, SAST/DAST, WAF and runtime protection, and remediation follow-up. 

• Triage security findings, assess exploitability and business impact, and provide practical mitigation guidance. 

• Manage bug-bounty and external security-research programs, including researcher engagement and vulnerability triage. 

• Lead the development of security tooling, automation, and attack-surface monitoring capabilities, and enhance the team’s capabilities using AI tools. 

• Coordinate security projects and collaborate with incident response teams during product-security incidents. 

• Develop security training and enablement programs for R&D and security champions. 

• Promote continuous improvement in security practices and support technical compliance efforts related to GDPR, CCPA, and other applicable requirements. 

 

Requirements:

Must-have: 

• 5+ years of hands-on experience in application security, product security, or a closely related security engineering discipline. 

• Strong expertise in web application, API, mobile application, and service-to-service security. 

• Strong understanding of common application-security weaknesses and modern attack techniques, including authentication and authorization flaws, injection, SSRF, business-logic abuse, secrets exposure, supply-chain risk, and cloud misconfiguration. 

• Strong understanding of Kubernetes, containers, microservices, cloud environments, and CI/CD pipelines. 

• Strong communication and stakeholder-management skills, business-enabler attitude with the ability to influence engineering teams and explain technical risk clearly. 

• Strong analytical, problem-solving, ownership, and people-leadership skills. 

Advantages:

• Experience leading or managing an application/product security team or function. 

• Experience with SSDLC, threat modeling, secure design reviews, security architecture, vulnerability remediation, and risk prioritization. 

• Experience with penetration testing, vulnerability management, SAST, DAST, software composition analysis, and API security testing. 

• Experience with external attack-surface management, runtime application protection, WAF, API gateways, service-mesh security, or cloud security.