SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Cyera is building the security operating model for the age of AI. The company provides a unified control plane that secures data, access, and AI models across organizations. You will join as Head of Application Security, reporting to the CISO, and lead a team spanning secure development, vulnerability management, product security incident response, and offensive security.
You will build a modern product security program aligned with how R&D builds software: security checks embedded in the pipeline, clear standards for engineers, fast vulnerability handling, and AI-assisted workflows. You'll partner closely with engineering and product leaders to make security the default, not a gate at the end.
Key responsibilities include:
**Strategy & Vision**: Define multi-year product security strategy and operating model in partnership with the CISO, aligned to company priorities and risk appetite.
**Secure Development Lifecycle**: Own SDLC standards, build controls, threat modeling, design review, and exception processes.
**Vulnerability Management**: Own discovery, prioritization, assignment, and closure of vulnerabilities with clear service levels and reporting.
**Security Tooling**: Own the application security toolchain (static/dynamic analysis, dependency scanning, secrets detection, SBOM/AIBOM generation) and ensure every control delivers value.
**Offensive Security**: Lead penetration testing, bug bounty, and attack surface management programs; ensure findings are fixed and trends feed into standards.
**AI Security**: Set the approach for securing AI features and agentic systems, including testing for prompt injection, data exposure, and misuse.
**Metrics & Investment**: Define KRIs, report to CISO and engineering leadership, own budget, headcount, and vendor strategy.
**Engineering Partnership**: Embed security in design, build, and release processes; align priorities and tradeoffs with R&D, product, and platform leaders.
**Team Leadership**: Build, lead, and develop managers, engineers, and program managers; set structure, hiring plans, succession, and coach leaders.
**Agentic AppSec Fleet**: Design and run AI agents for AppSec work at scale (triaging findings, validating exploitability, reviewing PRs/designs, drafting threat models, routing vulnerabilities). Define guardrails, approval points, evaluation methods, and audit trails.
**Requirements:**
- 12+ years in cybersecurity
- At least 6 years in application or product security
- At least 4 years leading managers or multiple teams
- Deep knowledge of secure software development, threat modeling, code and architecture review, and common vulnerability classes in cloud-native, API-driven, and containerized applications
- Proven record of building or scaling an application security program (tooling, standards, vulnerability management, measurable risk reduction)
- Record of driving security change across large engineering organizations through partnership and clear standards
- Experience hiring, developing, and retaining strong security engineers and managers
- Experience handling product vulnerabilities and coordinated disclosure
- Ability to explain risk and tradeoffs clearly to engineers, executives, and customers; sound decision-making under uncertainty
**Nice to Have:**
- Offensive security background (penetration testing, red teaming, bug bounty)
- AI security experience (LLM, agent, or other AI-enabled products)
- Experience at cloud, SaaS, or data security company
- Experience with FedRAMP, SOC 2, ISO 27001, or similar regulated environments
- Certifications: CISSP, OSCP, CSSLP, or similar
