Head of Application Security

Harvey Nash; Greater London; On-site; GBP 120,000 - 180,000; Full time

Benefits offered by this job

Expenses covered for London visits

Job summary

Harvey Nash partners with a high-growth cybersecurity product business to hire a Head of DevSecOps who will own and evolve the product security function. This is a hands-on leadership role with strategic impact across engineering, security, and product teams.

You will drive security across the SDLC, lead threat modelling, pen testing, vulnerability management, and incident response, while mentoring a small security engineering team.

Qualifications

• Leadership experience in DevSecOps / AppSec.
• Hands-on with SAST, DAST, SCA in CI/CD.
• Deep understanding of modern product security.
• Experience balancing security with delivery in a product environment.
• Strong stakeholder skills across engineering and exec level.

Responsibilities

• Own product security posture end-to-end.
• Define and drive DevSecOps strategy across the SDLC.
• Lead threat modelling, pen testing, and vulnerability management.
• Embed security into engineering teams and delivery pipelines.
• Own supply chain security and SBOM reporting.
• Lead and grow a small, high-calibre team.
• Act as a key voice in incident response and risk management.
• Explore and scale AI-driven / agentic security tooling.

Skills

Leadership DevSecOps / AppSec

SAST, DAST, SCA in CI/CD

Product security strategy

Security-delivery balance

Stakeholder management

Tools

SAST

DAST

SCA

Job description

Head of DevSecOps / Security Engineering (1 day/month London - Expenses Covered)

We’re working with a high-growth cybersecurity product business looking to hire a Head of DevSecOps to own and evolve their product security function.

This is a hands-on leadership role with real ownership, setting strategy whilst still being close enough to the detail to influence key technical decisions.

The role:

• Own product security posture end-to-end
• Define and drive DevSecOps strategy across the SDLC
• Lead threat modelling, pen testing, and vulnerability management
• Embed security into engineering teams and delivery pipelines
• Own supply chain security and SBOM reporting
• Lead and grow a small, high-calibre team
• Act as a key voice in incident response and risk management
• Explore and scale AI-driven / agentic security tooling

What they’re looking for:

• Proven leadership in DevSecOps / AppSec
• Strong hands-on experience with SAST, DAST, SCA in CI/CD
• Deep understanding of modern product security
• Experience balancing security with delivery in a product environment
• Strong stakeholder skills across engineering and exec level

Nice to have:

• Cloud security (AWS / Azure / GCP)
• Experience securing AI / ML or agent-based systems
• Exposure to OWASP, NIST, ISO or similar
• Security-first product business with strong technical DNA
• Backed for growth and scaling
• Remote-first with just 1 day per month in London (expenses covered)