AppsFlyer is hiring an Application Security Team Lead to manage a team of application security engineers. Responsibilities include leading the team, owning and evolving the Secure SDLC program, managing penetration testing and bug bounty programs, driving code security practices, integrating security into CI/CD pipelines, defining security KPIs, partnering with R&D to remediate vulnerabilities, participating in incident response, and running security training programs. Requirements include 7+ years in application/product security, 2+ years managing security engineers, a relevant bachelor's degree, deep knowledge of web and API security, experience with security testing tools, SSDLC programs, bug bounty management, cloud security, and excellent communication skills. Bonus points for coding experience, AI security knowledge, and security certifications.
What you'll do
Lead, mentor and grow a team of application security engineers, with full people management responsibility, including hiring, goal setting, performance reviews and career development
Similar jobs
More roles worth a look
Related opportunities based on specialty and working model so candidates can keep momentum.
Own and evolve AppsFlyer's Secure SDLC (SSDLC) program, embedding security controls and standards across the development lifecycle
Own the penetration testing program, covering internal testing, external vendor engagements, scoping, and follow-up on fixes
Manage the bug bounty program, including triage, validation, severity rating, researcher communication, and driving fixes with R&D
Drive code security at scale by owning SAST, SCA, secrets detection and secure code review practices
Build security into CI/CD pipelines, making security guardrails automated, reliable and developer-friendly
Define and track application security KPIs, and report on risk posture and progress to Security leadership
Partner with R&D leaders and cross-functional teams to prioritize and remediate vulnerabilities based on risk
Take part in security incident response and lead post-incident reviews for application-related incidents
Run secure development training and security champions programs for developers
Stay current with emerging threats, vulnerabilities and industry best practices in application and product security
Requirements
7+ years of experience in application security, penetration testing or product security, ideally in a SaaS company
2+ years of experience managing security engineers
Bachelor's degree in Computer Science, Information Security, or a related field
Deep understanding of web and API security concepts and protocols (e.g., OWASP Top 10, OWASP API Top 10, SSL/TLS, OAuth/OIDC)
Hands-on experience with security testing tools such as Burp Suite, OWASP ZAP, or similar
Proven experience building or running SSDLC programs, including SAST, DAST and SCA tooling and integrating it into CI/CD pipelines (e.g., GitHub Actions, Jenkins, GitLab CI)
Experience managing a bug bounty program (e.g., HackerOne, Bugcrowd) and working with external pentest vendors
Experience with cloud security principles and best practices (e.g., AWS, GCP), containers and Kubernetes
Excellent communication skills, with the ability to explain security risks and recommendations to technical and non-technical stakeholders as well as management
Experience working with large-scale R&D environments
