We use PostHog and Clarity to improve the site, and Meta Pixel to measure page views and ad effectiveness. Usage data may include page addresses and browser identifiers. You can opt out of collection at any time. Details in the Privacy Policy
Application Security Team Lead at AppsFlyer · Trevo
AppsFlyer's Security team is looking for an experienced security leader to join us as an Application Security Team Lead. You'll lead a team of application security engineers and own how we secure our products, from design through code to production. You'll work closely with our R&D, DevOps and Product teams to build security into how we develop software, at scale.
The ideal candidate is a hands-on leader who is highly motivated, always eager to learn and has a 'can do' attitude. You'll play a pivotal role in protecting our products against security threats and vulnerabilities by combining technical depth, sound judgment and clear communication. You'll set the direction for application security at AppsFlyer, grow the people on your team, and balance strategic programs with hands-on technical work.
What you'll do
Lead, mentor and grow a team of application security engineers, with full people management responsibility, including hiring, goal setting, performance reviews and career development.
Own and evolve AppsFlyer's Secure SDLC (SSDLC) program, embedding security controls and standards across the development lifecycle.
Own the penetration testing program, covering internal testing, external vendor engagements, scoping, and follow-up on fixes.
Manage our bug bounty program, including triage, validation, severity rating, researcher communication, and driving fixes with R&D.
Drive code security at scale by owning SAST, SCA, secrets detection and secure code review practices.
Build security into our CI/CD pipelines, making security guardrails automated, reliable and developer-friendly.
Define and track application security KPIs, and report on risk posture and progress to Security leadership.
Partner with R&D leaders and cross-functional teams to prioritize and remediate vulnerabilities based on risk.
Take part in security incident response and lead post-incident reviews for application-related incidents.
Run secure development training and security champions programs for developers.
Stay current with emerging threats, vulnerabilities and industry best practices in application and product security.
What you have
7+ years of experience in application security, penetration testing or product security, ideally in a SaaS company.
2+ years of experience managing security engineers.
Bachelor's degree in Computer Science, Information Security, or a related field.
Deep understanding of web and API security concepts and protocols (e.g., OWASP Top 10, OWASP API Top 10, SSL/TLS, OAuth/OIDC).
Hands-on experience with security testing tools such as Burp Suite, OWASP ZAP, or similar.
Proven experience building or running SSDLC programs, including SAST, DAST and SCA tooling and integrating it into CI/CD pipelines (e.g., GitHub Actions, Jenkins, GitLab CI).
Experience managing a bug bounty program (e.g., HackerOne, Bugcrowd) and working with external pentest vendors.
Experience with cloud security principles and best practices (e.g., AWS, GCP), containers and Kubernetes.
Excellent communication skills, with the ability to explain security risks and recommendations to technical and non-technical stakeholders as well as management.
Experience working with large-scale R&D environments.