Application Security Lead

📋 Job Overview

Application Security shouldn't be the team that says no. At Surfshark, we want it to be the team that makes shipping fast and safe feel like the same thing. We're looking for an Application Security Team Lead to build and grow our global Application Security program: someone who leads a strong team, sets the standard for secure software design, and turns security into something engineers actually want to work with. Less bottleneck, more enabler.

🏢 About Surfshark

Surfshark is a company that provides online privacy and security solutions.

🎯 The Role

You will build, lead, and mentor a security engineering team, and set the AppSec strategy and roadmap.

✅ Key Responsibilities

• Build, lead, and mentor a security engineering team, and set the AppSec strategy and roadmap
• Define secure-by-default patterns and paved-road guardrails so developers ship rapidly and safely
• Run threat modeling for critical services and high-risk features, and turn findings into clear engineering work
• Build and grow a company-wide Security Champions program across distributed squads
• Set vulnerability management standards, risk-scoring, and remediation SLAs, and tune detection tooling for high signal and low noise
• Own software supply chain security: dependency risk, SBOMs, pipeline integrity, and artifact signing
• Define security baselines for AI and LLM deployments, and set the rules for how engineers use AI-generated code
• Collaborate with SecOps, GRC, Products Engineering teams and other teams to ensure Applications security

📌 Required Qualifications

• Proven experience in Application Security, DevSecOps, or security-focused software engineering
• Proven experience leading or formally mentoring a team of security engineers
• A track record of building and scaling an AppSec program, not just running third-party tools
• Strong command of AppSec fundamentals: SSDLC, OWASP, CWE, CVSS, modern cryptography, and secure architecture
• Deep expertise in either Application Security or Cloud Workload Security, with solid working knowledge of the other
• Hands-on experience integrating and tuning pipeline security tools (SAST, SCA, DAST, secrets and IaC scanning)
• Working knowledge of software supply chain and AI/LLM security (OWASP Top 10 for LLMs)
• Scripting skills (Python, Bash, PowerShell, or Go) and experience with Infrastructure as Code

⭐ Desirable Experience

No specific desirable experience mentioned.

🎁 Benefits

• Growth and learning opportunities: time dedicated to learning, conferences, online learning platforms, and books for your professional development
• Health and wellness: we want you to feel and be your best. That's why we offer various benefits, from online workouts and a physical coach to health insurance and regular mental health checks
• Tools of your choice: choose the technical equipment and tools you need to do your best work
• Community and celebrations: get ready for long-lasting traditions such as yearly workation, Friday get-togethers, various team buildings and company celebrations
• Work-life balance: We encourage working in the office, with the possibility of up to two remote days per week. Plus, with our WFA policy, you can work from almost anywhere in the world
• More days off: additional vacation days depending on your tenure
• Premium Surfshark accounts: for you, your family, and friends
• Gross salary: 6500 - 8000 Eur/month. Although it may vary depending on your skills and experience

🛂 Visa & Eligibility

No specific visa or eligibility information mentioned.