Practice Director – Application Security

This is a fully remote position, open to applicants in United States.

📋 Description

• Lead the expansion, effectiveness, and continuous enhancement of AHEAD’s Application Security practice.

• Cultivate executive client relationships while identifying security challenges and opportunities.

• Generate and progress sales opportunities from initial discovery to proposal, negotiation, and delivery transition.

• Formulate the growth strategy for the practice, service offerings, and go-to-market initiatives.

• Facilitate client discovery, visioning, and solution-design workshops.

• Own or contribute to opportunity plans, pipeline development, forecasts, and growth objectives for the practice.

• Create, refine, and commercialize Application Security solutions, including AI Application Security, AI-DLC, program assessments, secure SDLC and DevSecOps enablement, application and API security, threat modeling, ASPM, and software supply-chain security.

• Forge partnerships with AI development and security technology providers.

• Integrate Application Security services with cloud, infrastructure, data, AI, and other capabilities at AHEAD.

• Build and enhance the practice team through hiring, coaching, mentoring, and succession planning.

• Oversee practice capacity and resource planning.

• Establish accountability, promote continuous improvement, encourage knowledge sharing, enhance client service, and ensure financial performance.

• Represent AHEAD through executive briefings, industry events, partner and client engagements, and thought leadership initiatives.

• Provide executive oversight and leadership for selected strategic or complex projects.

• Lead or advise on client strategy, roadmap, architecture, and planning sessions.

• Guide application security assessments, maturity enhancements, secure SDLC controls, threat modeling, DevSecOps enablement, application and API security reviews, and remediation planning.

• Convert technical findings into prioritized actions and business implications.

• Monitor the health of engagements, including milestones, dependencies, risks, and client expectations.

• Review key deliverables and executive presentations.

• Coach engagement leaders and practitioners on client communication and delivery excellence.

• Maintain a selective client delivery role to validate service approaches and inform the practice portfolio.

⛳️ Requirements

• 15+ years of consulting or equivalent professional experience in information security, application security, cloud security, or a related area.

• Extensive leadership experience in a practice, program, business development, or consulting leadership capacity.

• Proven experience in developing talent and influencing business outcomes.

• Demonstrated success in building client relationships and expanding consulting opportunities.

• Experience in leading discovery, shaping solutions, scoping, proposal development, and delivering executive presentations.

• Experience in developing or scaling professional services, security capabilities, or go-to-market offerings.

• Experience in establishing, assessing, or maturing application security and DevSecOps programs.

• Strong understanding of application and API security concepts, modern software delivery practices, cloud-native architectures, and related tools.

• Ability to manage complex client engagements, navigate executive stakeholder dynamics, and guide teams through ambiguity, competing priorities, and delivery risks.

• Excellent written, verbal, presentation, facilitation, and relationship-building abilities.

• Strong business acumen and strategic judgment.

• An undergraduate degree in Computer Science, Business Management, or a related field is preferred but not required.

• Industry-recognized security certifications are preferred, such as CISSP, CCSP, CSSLP, or relevant GIAC certifications.

• Knowledge of application security program strategy and maturity, secure SDLC, DevSecOps, and secure coding practices.

• Proficiency in application and API threat modeling, architecture and design reviews, and risk-based vulnerability prioritization.

• Familiarity with ASPM and SAST, DAST, SCA, secrets detection, and related tools.

• Understanding of API security, including REST and GraphQL risks, authentication and authorization patterns, and OWASP guidance.

• Knowledge of CI/CD and software supply-chain security, including dependency and open-source risk management, SBOM practices, artifact integrity, and provenance.

• Expertise in cloud-native application security concerning infrastructure-as-code, containers, Kubernetes, runtime context, and cloud posture.

• Familiarity with security frameworks and maturity models such as OWASP SAMM and DSOMM.

• Ability to evaluate application security platforms in relation to client outcomes.

🏝️ Benefits

• Medical, Dental, and Vision Insurance.

• 401(k) plan.

• Paid company holidays.

• Paid time off.

• Paid parental and caregiver leave.

• Cross-department training and development opportunities.

• Sponsored certifications and credentials for ongoing learning.

• Access to a multi-million-dollar technology lab.

• Options to opt-out of AI application and resume review without penalty.

• Options to opt-out of interview recording and transcription without penalty.