About the Role
You will lead application security across browser extensions, mobile applications, backend services, DeFi primitives, stablecoins, and smart contracts. You will set security strategy and operating practices, manage and develop a senior team, conduct code reviews and threat modelling, strengthen the secure development lifecycle, and oversee vulnerability management, external testing, assurance, and incident support.
Requirements
•At least eight years of application security or security-focused software engineering experience, including two years leading people
•Practical code review skills in TypeScript, JavaScript, Go, or Solidity
•Experience securing client and backend applications, including distributed authentication, authorisation, and key management
•Experience building or significantly improving an application security programme
•Experience with security reviews, automated testing, AI scanning, vulnerability management, and developer support
•Experience securing software supply chains, including dependency policies, software composition analysis, npm, artefact integrity, and CI/CD
•Experience running bug bounty and penetration testing programmes and managing external providers
•Working knowledge of EVM smart contract security
•Experience delivering security improvements through engineering teams outside the reporting line
•Clear written communication
Preferred:
•Offensive security qualifications, bug bounty, or CTF experience
•Experience securing browser extensions or mobile applications
•Experience securing AI-enabled development workflows or production AI components
•Crypto, Web3, fintech, payments, or infrastructure security experience
•Knowledge of or interest in applied cryptography
•Familiarity with state-actor supply-chain and social-engineering attacks
•Experience supporting SOC 2 or ISO 27001 assessments
Responsibilities
•Lead and develop the Application Security team, including hiring, performance management, and career development
•Set the Application Security strategy, goals, OKRs, and KPIs
•Report application security progress, coverage, remediation performance, and material gaps to Security leadership
•Define and assess security review requirements across development and release
•Lead threat modelling and security design reviews across clients, APIs, and backend services
•Define software supply chain security requirements and validate controls for dependencies, builds, artefacts, and publishing
•Lead security code reviews across applications and smart contracts
•Evolve the secure development lifecycle for AI agents, generated code, and AI components
•Integrate and evaluate security testing tools and findings
•Provide secure coding guidance, reusable libraries, training, and a security champions programme
•Own vulnerability assessment, triage, prioritisation, remediation tracking, and risk escalation
•Manage bug bounty, penetration testing, AI security scanning, external providers, researcher relationships, rewards, and vulnerability disclosure
•Provide evidence for audits, assurance reviews, and due diligence
•Support incidents with vulnerability analysis and remediation expertise
Benefits
•Remote-friendly work environment
