Global Application Security Lead

Lockton, Inc. is hiring a Global Application Security Lead for a hybrid role in Overland Park, KS. This position drives application security and DevSecOps execution across business units and regions, with ownership of secure SDLC controls, security tooling operations, testing, and production hardening. You will lead hands-on technical work while managing an application security engineering function, partnering across engineering and security stakeholders, and translating technical outcomes into executive and audit-ready reporting.

Responsibilities

• Own day-to-day execution of the application security and DevSecOps program across all business units and regions.
• Embed security controls throughout the software development lifecycle, from secure design and threat modeling through static and composition analysis, dynamic testing, secrets management, and production hardening.
• Manage the application security engineering team; set working standards for engineering teams; run the AppSec tooling estate; and perform and direct application-level testing.
• Execute the phased application security roadmap set by the Global Enterprise Security Architect, including milestone delivery, dependencies, and status reporting.
• Operate tiered application governance (T1/T2/T3), including risk tiering intake, tier-based control expectations, and periodic re-tiering of the application portfolio.
• Define and maintain secure SDLC standards, secure coding guidelines, and pipeline control gates.
• Track and report AppSec operational metrics including scan coverage, finding volume by severity, mean time to remediate, SLA adherence, and exception backlog.
• Maintain the application security exception and risk acceptance register, escalating material risk to the Global Enterprise Security Architect.
• Own the AppSec tooling estate end to end (SAST, SCA, DAST, secrets scanning, and container and IaC scanning), including deployment, tuning, rule management, and pipeline integration.
• Lead tooling proof of concept exercises by defining evaluation criteria, running technical bake-offs, and producing recommendations for architecture review.
• Perform and direct internal application penetration testing, manual code review, and threat modeling for Tier 1 and high-risk applications.
• Triage findings across all sources, validate exploitability, remove false positives, and drive remediation with engineering teams.
• Manage third-party penetration testing scoping, vendor coordination, finding validation, and retest closure.
• Maintain guardrails for AI-assisted development, including approved AI coding tools, agentic tooling, MCP server usage, and dependency provenance controls covering supply chain and slopsquatting risk.
• Provide technical mentorship on secure code review, exploitation technique, tooling operation, and finding write-up quality.
• Build and develop the application security engineering team, including onshore staff and LGCC offshore engineering resources.
• Own hiring and people practices for the function, including role definition, interview loop design, candidate assessment, onboarding, performance reviews, and career development.
• Define career paths, technical skill matrices, and individual development plans for application security engineers, and manage team capacity against roadmap and inbound intake demand.
• Build runbooks and playbooks to reduce dependence on individual knowledge for AppSec operations.
• Coordinate across US, UK, MENA, and APAC time zones and partner with Engineering, DevOps, Platform, and Product teams to embed controls with minimal friction to release velocity.
• Act as first-line technical escalation for application security findings, remediation disputes, and release blocking decisions, escalating unresolved risk decisions upward.
• Support GRC and audit teams with evidence, control narratives, and testing artifacts for NYDFS 23 NYCRR 500, HITRUST, GDPR, and DORA obligations.
• Support incident response for software-related incidents, including vulnerability triage, exploit analysis, and root cause contribution.
• Translate technical findings into business impact for application owners and non-technical stakeholders.
• Operate the Security Champions program with champion selection, enablement content, and recurring working sessions.
• Deliver secure coding training and targeted enablement based on observed defect patterns.
• Drive shift-left adoption so security defects are found and fixed during development rather than at release gates.

Requirements

• 10 years in application security, product security, or secure software engineering, including 2 years in a lead or management capacity.
• Demonstrated people management experience, including hiring, performance management, and career development of security or engineering staff.
• Experience leading distributed teams across multiple time zones, including offshore engineering resources.
• Hands-on experience operating SAST, SCA, DAST, and secrets scanning tooling at enterprise scale, including pipeline integration and rule tuning.
• Proven ability to perform manual secure code review and application penetration testing, with working command of Burp Suite Pro or equivalent.
• Working knowledge of at least two of: .NET, Java, Python, JavaScript/TypeScript, Go.
• Practical experience securing CI/CD pipelines and cloud-native workloads, with preference for Azure and Azure DevOps or GitHub Actions.
• Fluency with OWASP Top 10, OWASP ASVS, OWASP SAMM or BSIMM, and CWE.
• Experience supporting regulatory or certification audits in a regulated industry.
• Ability to write clear, structured technical findings and standards documentation for both engineering and audit audiences.

Technologies

• SAST, SCA, DAST, secrets scanning, container scanning, IaC scanning, Burp Suite Pro
• .NET, Java, Python, JavaScript/TypeScript, Go
• CI/CD pipelines, Azure, Azure DevOps, GitHub Actions
• OWASP Top 10, OWASP ASVS, OWASP SAMM, BSIMM, CWE
• AI-assisted development, agentic tooling, MCP server usage
• SBOM, dependency provenance controls
• NYDFS 23 NYCRR 500, HITRUST, GDPR, DORA

Position Details

• Reports to: Global Enterprise Security Architect, Security Architecture and Engineering (SA&E).
• Location: Kansas City, MO (in-office three days per week).
• Travel: Periodic travel to regional technology hubs.
• Coverage: US, UK, MENA, and APAC time zones.
• Direct reports: 2 application security engineers, plus technical direction of LGCC offshore engineering resources.

Preferred Qualifications

• Financial services, insurance, or other regulated industry experience.
• Experience with software supply chain security, SBOM generation, and dependency provenance controls.
• Experience defining controls for AI-assisted development tooling and AI-generated code review.
• Certifications such as OSWE, OSCP, GWAPT, CSSLP, or CISSP.

First 12 Months - Success Measures

• AppSec tooling deployed and integrated across 80% of Tier 1 and Tier 2 repositories with agreed scan coverage.
• Risk tiering completed for the full application portfolio and control expectations published per tier.
• Remediation SLAs defined, agreed with engineering leadership, and reported monthly.
• Security Champions program operating with named champions in each major engineering group.
• AI-assisted coding guardrails implemented and adoption measured across the developer population.
• Team structure, role expectations, and individual development plans established for all direct reports.