Application Security Lead

Tower; Auckland; Híbrido; NZD 140.000 - 200.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

26 weeks parental leave

Birthday off

22 days annual leave

Wellness leave

Career growth opportunities

Flexible working

Office in Auckland

Discounts on Tower products

Free life insurance

Descripción de la vacante

Tower is seeking an experienced application security professional to shape how security is built into software from the start. You will drive secure-by-design practices across the SDLC, defend APIs and AI workloads, and partner with engineers to deliver secure and resilient applications.

The role emphasizes an adversarial mindset, threat modelling, and collaboration with engineering teams to remediate vulnerabilities and raise secure coding standards. Flexible working in Auckland is offered.

Formación

• 5+ years hands-on application security experience with adversarial mindset.
• Experience across threat modelling, API security and secure CI/CD pipelines.
• Familiarity with SAST, DAST, SCA and secret-scanning tools.
• Knowledge of OWASP Top 10 and GenAI/LLM security concepts.

Responsabilidades

• Lead the Secure Software Development Lifecycle and embed secure-by-design practices.
• Identify and validate security risks across applications, APIs and AI workloads.
• Partner with developers to deliver secure and resilient solutions.

Conocimientos

Application security

Penetration testing

Red teaming

Threat modelling

API security

Secure SDLC

CI/CD security

OWASP Top 10

GenAI security

LLM security

MITRE ATLAS

Security automation

Educación

Relevant certifications (OSCP, OSWE, GWAPT, CSSLP)

Herramientas

Azure/Entra ID

Terraform

SAST/DAST tools

SCA/secret scanning tools

Descripción del empleo

Are you an experienced application security professional ready to shape how security is built into software from the start? We’re looking for someone with a strong offensive security mindset who enjoys getting into the code, challenging real-world risk, and partnering with engineers to build secure and resilient applications, APIs and AI solutions.

As a proud Kiwi born and bred insurer, we pride ourselves on challenging the status quo and moving fast to make things happen. We’re here to create beautifully simple, rewarding experiences for our customers and communities, and we’re working hard to protect the future of Aotearoa.

At its heart, insurance is about helping people through the unexpected. Doing what’s right for our customers, especially in tough times, gives real purpose to our work.

Your day-to-day would look like:

• Lead Tower’s Secure Software Development Lifecycle, embedding secure-by-design practices across how software is designed, built and released.
• Identify and validate security risks across applications, APIs and AI workloads, bringing an adversarial mindset to strengthen resilience.
• Partner closely with developers and engineering teams to embed practical security into delivery and build trusted, secure solutions.

In your first 6-12 months, success will look like:

• A clear application security vision is established, with secure-by-design practices embedded across engineering.
• SSDLC is embedded into delivery workflows, with effective security controls, gates and standards across GitHub and Jira Cloud.
• Security risks are identified and prioritised effectively, helping engineering teams focus on genuine vulnerabilities and appropriate remediation.
• Security capability is strengthened across engineering, with developers confident applying secure coding practices and security champions established across teams.

To thrive in this role, you’ll bring:

• 5+ years’ hands-on application security experience, ideally across penetration testing, red teaming or secure software development, with a strong adversarial mindset.
• Practical experience across threat modelling, API security and secure CI/CD, including SAST, DAST, SCA and secret-scanning tools.
• Strong knowledge of modern security practices and frameworks, including OWASP Top 10, GenAI/LLM security and MITRE ATLAS.
• Experience partnering with engineering teams to remediate vulnerabilities, improve secure coding practices and influence security outcomes without formal authority.
• Exposure to AI/LLM security, security automation, Azure/Entra ID or Terraform is highly regarded, along with certifications such as OSCP, OSWE, GWAPT or CSSLP.

We invest in you.

We’re serious about looking after our people. Along with a competitive salary, we offer a bunch of perks and benefits to support you and celebrate the work you do:

• 26 weeks of paid parental leave for the primary carer and 4 weeks for partners
• A paid day off on your birthday
• 22 days annual leave, plus two extra annual leave days and the option to buy up to eight more
• Wellness leave
• Career growth and internal progression opportunities
• Flexible working and a beautiful, modern office in Auckland
• Discounts on Tower insurance products
• Free life insurance