Application Security Team Lead

About the role

AppsFlyer is seeking an experienced security leader to head its Application Security team. You will own the security of our products from design through production, working closely with R&D, DevOps and Product teams.

Key responsibilities

• Lead, mentor and grow a team of application security engineers, handling hiring, performance reviews and career development.
• Own and evolve the Secure SDLC program, embedding security controls across the development lifecycle.
• Manage the penetration testing program, including internal testing, external vendor engagements and remediation follow‑up.
• Run the bug bounty program, handling triage, validation, severity rating and coordination with researchers.
• Drive code security at scale by owning SAST, SCA, secrets detection and secure code review practices.
• Integrate security guardrails into CI/CD pipelines, making them automated and developer‑friendly.
• Define and track application security KPIs, reporting risk posture to security leadership.
• Partner with R&D leaders to prioritize and remediate vulnerabilities based on risk.
• Participate in security incident response and lead post‑incident reviews for application‑related incidents.
• Run secure development training and security champion programs for developers.

Required profile

• 7+ years of experience in application security, penetration testing or product security, preferably in a SaaS environment.
• 2+ years of experience managing security engineers.
• Bachelor's degree in Computer Science, Information Security or a related field.
• Strong communication skills to explain security risks to technical and non‑technical stakeholders.

Required skills

• Deep knowledge of web and API security (OWASP Top 10, OWASP API Top 10, SSL/TLS, OAuth/OIDC).
• Hands‑on experience with security testing tools such as Burp Suite and OWASP ZAP.
• Experience building SSDLC programs with SAST, DAST and SCA tooling integrated into CI/CD pipelines (GitHub Actions, Jenkins, GitLab CI).
• Management of bug bounty platforms (HackerOne, Bugcrowd) and coordination with external pentest vendors.
• Familiarity with cloud security (AWS, GCP), containers and Kubernetes.