Head of Application Security

Description

About Cyera

Come join the company building the security operating model for the age of AI. AI has changed how data is used — and security must change with it. Cyera's mission is to empower businesses to accelerate AI Adoption by defining a holistic approach to securing AI - from data to access to model. Instead of perimeter controls and static policies, Cyera provides a unified control plane that understands relationships between data, access, and behaviors across humans, systems, and AI. Backed by the world’s leading investors and working with a large and growing list of Fortune 1000 companies, we are looking for world-class talent to join us as we usher in the new era of data and AI security.ty job that is used for creating requisitions 'from scratch'

About the Role

Join our team as the Head of Application Security. You will build and lead the application and product security function for a fast-growing data and AI security company, set its strategy, and be accountable for the security of what we ship. You will report to the CISO and lead a team that spans secure development, vulnerability management, product security incident response, and offensive security.

You will build a modern product security program that fits how R&D builds software: security checks in the pipeline, clear standards engineers can follow, fast and fair vulnerability handling, and AI-assisted workflows that remove manual review work. You will partner closely with engineering and product leaders so that secure is the default way to ship, not a gate at the end.

The ideal candidate has 12 or more years of cybersecurity experience, including at least 6 years in application or product security and at least 4 years leading managers or multiple teams. We are looking for a leader who combines deep technical credibility with the judgment, influence, and operating discipline to scale a program across a large engineering organization.

What You’ll Do

• Strategy and Vision: Define the multi-year product security strategy and operating model, aligned to company priorities and risk appetite, in partnership with the CISO.
• Secure Development Lifecycle: Own the secure SDLC: the standards R&D builds against, the controls that gate or warn on a build, assisting with threat modeling and design review, and the exception process.
• Vulnerability Management: Own how vulnerabilities in our product and production environment are found, prioritized, assigned, and closed, with clear service levels and reporting.
• Security Tooling: Own the application security toolchain, including static and dynamic analysis, dependency and container scanning, secrets detection, and software supply chain visibility such as SBOM and AIBOM generation. Make sure every control has an owner and delivers value.
• Offensive Security: Lead the offensive security program, including penetration testing, bug bounty, and attack surface management. Make sure findings are fixed and that trends feed back into standards and training.
• AI Security: Set the approach for securing the AI features and agentic systems we build, including testing for prompt injection, data exposure, and misuse.
• Metrics and Investment: Define product security metrics and key risk indicators, report them to the CISO and engineering leadership, and own the budget, headcount plan, and vendor strategy for the function.
• Engineering Partnership: Work with R&D, product, and platform leaders to embed security in how the company designs, builds, and releases software, and to agree on priorities and tradeoffs.
• Team and Talent: Build, lead, and develop a team of managers, engineers, and program managers. Set structure, hiring plans, and succession, and coach leaders to lead well.
• Agentic AppSec Fleet: Design, build, and run a fleet of AI agents that take on AppSec work at scale, such as triaging scanner findings, validating exploitability, reviewing pull requests and designs for security issues, drafting threat models, proposing fixes, and routing vulnerabilities to the right owners. Define the guardrails, human approval points, evaluation methods, and audit trail that keep agent output accurate, safe, and trusted by engineers, and report the impact on risk and review capacity.

What You’ll Bring

• Experience: 12 or more years in cybersecurity, including at least 6 years in application or product security and at least 4 years leading managers or multiple teams.
• Application Security Depth: Deep knowledge of secure software development, threat modeling, code and architecture review, and common vulnerability classes in cloud-native, API-driven, and containerized applications.
• Program Building: Proven record of building or scaling an application security program, including tooling, standards, vulnerability management, and measurable reduction in risk.
• Engineering Influence: Record of driving security change across a large engineering organization through partnership and clear standards rather than formal authority.
• Leadership: Experience hiring, developing, and retaining strong security engineers and managers.
• Vulnerability Disclosure: Experience handling product vulnerabilities and coordinated disclosure, including communication with customers and security researchers.
• Communication and Judgment: Ability to explain risk and tradeoffs clearly to engineers, executives, and customers, and to make sound decisions under uncertainty.

Nice to Have

• Offensive Security Background: Hands-on experience in penetration testing, red teaming, or running a bug bounty program.
• AI Security: Experience securing LLM, agent, or other AI-enabled products.
• Security Product Company: Experience at a cloud, SaaS, or data security company.
• Regulated Environments: Experience supporting FedRAMP, SOC 2, ISO 27001, or similar programs.
• Certifications: CISSP, OSCP, CSSLP, or similar.