About the Role
Security shouldn't be the team that says no. At Surfshark, we want it to be the team that makes shipping fast and safe feel like the same thing. We're looking for an Application Security Team Lead to build and grow our global Application Security program: someone who leads a strong team, sets the standard for secure software design, and turns security into something engineers actually want to work with. Less bottleneck, more enabler.
Responsibilities
•Build, lead, and mentor a security engineering team, and set the AppSec strategy and roadmap
•Define secure-by-default patterns and paved-road guardrails so developers ship rapidly and safely
•Run threat modeling for critical services and high-risk features, and turn findings into clear engineering work
•Build and grow a company-wide Security Champions program across distributed squads
•Set vulnerability management standards, risk-scoring, and remediation SLAs, and tune detection tooling for high signal and low noise
•Own software supply chain security: dependency risk, SBOMs, pipeline integrity, and artifact signing
•Define security baselines for AI and LLM deployments, and set the rules for how engineers use AI-generated code
•Collaborate with SecOps, GRC, Products Engineering teams and other teams to ensure Applications security
Requirements
•Proven experience in Application Security, DevSecOps, or security-focused software engineering
•Proven experience leading or formally mentoring a team of security engineers
•A track record of building and scaling an AppSec program, not just running third-party tools
•Strong command of AppSec fundamentals: SSDLC, OWASP, CWE, CVSS, modern cryptography, and secure architecture
•Deep expertise in either Application Security or Cloud Workload Security, with solid working knowledge of the other
•Hands-on experience integrating and tuning pipeline security tools (SAST, SCA, DAST, secrets and IaC scanning)
•Working knowledge of software supply chain and AI/LLM security (OWASP Top 10 for LLMs)
•Scripting skills (Python, Bash, PowerShell, or Go) and experience with Infrastructure as Code
Benefits
•Growth and learning opportunities: time dedicated to learning, conferences, online learning platforms, and books for your professional development
•Health and wellness: online workouts and a physical coach, health insurance, and regular mental health checks
•Tools of your choice: choose the technical equipment and tools you need to do your best work
•Community and celebrations: yearly workation, Friday get-togethers, various team buildings and company celebrations
•Work-life balance: working in the office is encouraged, with the possibility of up to two remote days per week; WFA policy lets you work from almost anywhere in the world
•More days off: additional vacation days depending on tenure
•Premium Surfshark accounts for you, your family, and friends
•Gross salary: 6500 - 8000 Eur/month, may vary depending on skills and experience
