At a glance
- Experience
- 2+ years experience
- Location
- Herzliya
About the role
- AppsFlyer is seeking an Application Security Team Lead to head a team of application security engineers and oversee product security from design through code to production.
- The role involves close collaboration with R&D, DevOps, and Product teams to build scalable software security practices.
- The position requires a hands-on leader who can balance strategic programs with technical work while growing the team.
Responsibilities
- Lead, mentor and grow a team of application security engineers, with full people management responsibility, including hiring, goal setting, performance reviews and career development.
- Own and evolve AppsFlyer's Secure SDLC (SSDLC) program, embedding security controls and standards across the development lifecycle.
- Own the penetration testing program, covering internal testing, external vendor engagements, scoping, and follow-up on fixes.
- Manage our bug bounty program, including triage, validation, severity rating, researcher communication, and driving fixes with R&D.
- Drive code security at scale by owning SAST, SCA, secrets detection and secure code review practices.
- Build security into our CI/CD pipelines, making security guardrails automated, reliable and developer-friendly.
- Define and track application security KPIs, and report on risk posture and progress to Security leadership.
- Partner with R&D leaders and cross-functional teams to prioritize and remediate vulnerabilities based on risk.
- Take part in security incident response and lead post-incident reviews for application-related incidents.
- Run secure development training and security champions programs for developers.
Requirements
- 7+ years of experience in application security, penetration testing or product security, ideally in a SaaS company.
- 2+ years of experience managing security engineers.
- Bachelor's degree in Computer Science, Information Security, or a related field.
- Deep understanding of web and API security concepts and protocols (e.g., OWASP Top 10, OWASP API Top 10, SSL/TLS, OAuth/OIDC).
- Hands-on experience with security testing tools such as Burp Suite, OWASP ZAP, or similar.
- Proven experience building or running SSDLC programs, including SAST, DAST and SCA tooling and integrating it into CI/CD pipelines (e.g., GitHub Actions, Jenkins, GitLab CI).
- Experience managing a bug bounty program (e.g., HackerOne, Bugcrowd) and working with external pentest vendors.
- Experience with cloud security principles and best practices (e.g., AWS, GCP), containers and Kubernetes.
- Excellent communication skills, with the ability to explain security risks and recommendations to technical and non-technical stakeholders as well as management.
- Experience working with large-scale R&D environments.
Preferred qualifications
- Hands-on coding experience (e.g., Python, Go, Java, Node.js).
- Experience securing applications built on frontier AI models, including AI/LLM application security (e.g., OWASP Top 10 for LLMs).
- Experience with agentic AI security and MCP security.
- Security certifications such as OSCP, OSWE, or GWAPT.
- Being introduced by an AppsFlyer team member.
Skills
- Burp Suite
- OWASP ZAP
- SAST
- DAST
- SCA
- GitHub Actions
- Jenkins
- GitLab CI
- AWS
- GCP
- Kubernetes
- Python
Show all 15 skills
- Go
- Java
- Node.js
