Application Security Lead

Tower Insurance; Auckland; Presencial; NZD 140.000 - 180.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Parental leave (26 wks)

Birthday day off

Annual leave 22 days + 2

Wellness leave

Career progression

Flexible working

Office in Auckland

Product discounts

Life insurance

Descripción de la vacante

Tower Insurance is seeking an experienced application security professional to shape security from the start. You will lead secure-by-design practices across software design, build and release, targeting applications, APIs and AI workloads.

With 5+ years in application security, you will partner with engineering to embed security into delivery, mitigate vulnerabilities and drive secure coding practices across teams in a dynamic insurance environment in Auckland.

Formación

• 5+ years hands-on application security experience.
• Experience across threat modelling, API security and secure CI/CD.

Responsabilidades

• Lead Tower’s Secure Software Development Lifecycle, embedding secure-by-design practices across how software is designed, built and released.
• Identify and validate security risks across applications, APIs and AI workloads, bringing an adversarial mindset to strengthen resilience.
• Partner closely with developers and engineering teams to embed practical security into delivery and build trusted, secure solutions.

Conocimientos

Application security

Threat modelling

API security

Secure CI/CD

SAST

DAST

SCA

Secret scanning

OWASP Top 10

GenAI/LLM security

MITRE ATLAS

Security automation

Azure/Entra ID

Terraform

OSCP

OSWE

GWAPT

CSSLP

Herramientas

Azure/Entra ID

Terraform

Descripción del empleo

Are you an experienced application security professional ready to shape how security is built into software from the start? We’re looking for someone with a strong offensive security mindset who enjoys getting into the code, challenging real-world risk, and partnering with engineers to build secure and resilient applications, APIs and AI solutions.

As a proud Kiwi born and bred insurer, we pride ourselves on challenging the status quo and moving fast to make things happen. We’re here to create beautifully simple, rewarding experiences for our customers and communities, and we’re working hard to protect the future of Aotearoa.

At its heart, insurance is about helping people through the unexpected. Doing what’s right for our customers, especially in tough times, gives real purpose to our work.

Your day-to‑day would look like:

• Lead Tower’s Secure Software Development Lifecycle, embedding secure‑by‑design practices across how software is designed, built and released.
• Identify and validate security risks across applications, APIs and AI workloads, bringing an adversarial mindset to strengthen resilience.
• Partner closely with developers and engineering teams to embed practical security into delivery and build trusted, secure solutions.

In your first 6-12 months, success will look like:

• A clear application security vision is established, with secure‑by‑design practices embedded across engineering.
• SSDLC is embedded into delivery workflows, with effective security controls, gates and standards across GitHub and Jira Cloud.
• Security risks are identified and prioritised effectively, helping engineering teams focus on genuine vulnerabilities and appropriate remediation.
• Security capability is strengthened across engineering, with developers confident applying secure coding practices and security champions established across teams.

To thrive in this role, you’ll bring:

• 5+ years’ hands‑on application security experience, ideally across penetration testing, red teaming or secure software development, with a strong adversarial mindset.
• Practical experience across threat modelling, API security and secure CI/CD, including SAST, DAST, SCA and secret‑scanning tools.
• Strong knowledge of modern security practices and frameworks, including OWASP Top 10, GenAI/LLM security and MITRE ATLAS.
• Experience partnering with engineering teams to remediate vulnerabilities, improve secure coding practices and influence security outcomes without formal authority.
• Exposure to AI/LLM security, security automation, Azure/Entra ID or Terraform is highly regarded, along with certifications such as OSCP, OSWE, GWAPT or CSSLP.

We invest in you.

We're serious about looking after our people. Along with a competitive salary, we offer a bunch of perks and benefits to support you and celebrate the work you do:

• 26 weeks of paid parental leave for the primary carer and 4 weeks for partners
• A paid day off on your birthday
• 22 days annual leave, plus two extra annual leave days and the option to buy up to eight more
• Wellness leave
• Career growth and internal progression opportunities
• Flexible working and a beautiful, modern office in Auckland
• Discounts on Tower insurance products
• Free life insurance