Application Security Director

Huntington Bancshares, Inc.; Easton (OH); Teletrabalho; USD 160 000 - 260 000; Tempo integral

Vantagens oferecidas por esta oferta de emprego

Health insurance coverage

Wellness program

Life and disability insurance

Retirement savings plan

Paid leave programs

Paid holidays

PTO

Resumo da oferta

Huntington Bancshares, Inc. seeks an Application Security Director to lead enterprise security strategy across secure development, software assurance, cloud, API and supply chain risk.

You will manage managers and staff, align initiatives with business goals, and serve as a senior advisor on risk and resilience. In this role, you will set multi-year roadmaps, report to executives, influence budgeting, and build a security culture that emphasizes secure-by-design and AI safety.

Qualificações

• Min 6 yrs of experience in Information Security, preferably in the Operations domain.
• Min 4 years of Application Development (new).
• Min 4 yrs of experience in a Leadership role.
• Associate's Degree.
• 10+ years of progressive experience across application security, cybersecurity, technology risk, or related fields (preferred).

Responsabilidades

• Define and evolve the enterprise Application Security vision, strategy, operating model, governance framework, control objectives, and multi-year roadmap.
• Provide leadership across managers, professional staff, and related teams responsible for application security testing, secure SDLC, DevSecOps, API security, and software supply chain risk.
• Shape cybersecurity and technology strategy by influencing investment decisions, resource allocation, security architecture standards, and remediation priorities.
• Develop departmental plans, priorities, objectives, staffing, service models, and governance outcomes to improve security maturity and resilience.
• Lead strategy for the organization’s critical applications, cloud environments, and emerging technology initiatives.
• Define and execute the enterprise AI-enabled Application Security vision with secure-by-design principles throughout the SDLC.
• Lead collaboration across the financial services sector exchanging intelligence on threats and best practices.

Conhecimentos

Leadership

Strategy

App Security

Cloud security

AI security

Communication

Executive advisory

Formação académica

Associate's Degree

Descrição da oferta de emprego

Description Summary

The Application Security Director provides leadership to managers and professional staff responsible for enterprise application security, secure development, software assurance, software supply chain security, cloud-native security, API security, and emerging technology risk. This role is accountable for the performance and results of multiple related teams, develops departmental plans and priorities, and serves as an industry expert and strategic advisor for enterprise application security risk management.

Duties and Responsibilities

Enterprise Application Security Strategy

• Define and evolve the enterprise Application Security vision, strategy, operating model, governance framework, control objectives, and multi-year roadmap aligned to business, technology, and cybersecurity objectives.
• Provide leadership across managers, professional staff, and related teams responsible for application security testing, secure SDLC, software assurance, DevSecOps, API security, AI security, and software supply chain risk.
• Shape cybersecurity and technology strategy by influencing investment decisions, resource allocation, security architecture standards, platform direction, risk acceptance, and remediation priorities.
• Develop departmental plans, annual priorities, program objectives, staffing strategies, service models, and governance outcomes that improve application security maturity and enterprise resilience.
• Lead strategy for the organization’s most critical applications, digital platforms, cloud environments, customer-facing services, mergers and acquisitions, and emerging technology initiatives.
• Define and execute the enterprise vision for AI-enabled Application Security, integrating advanced analytics, automation, Generative AI, and secure-by-design principles throughout the SDLC to proactively identify, prioritize, report, remediate, and validate application security exposures while enabling secure innovation and reducing organizational risk.
• Lead strategic collaboration and information sharing across the financial services sector, serving as an active member of FS-ISAC and other trusted industry forums to exchange application security intelligence, secure development practices, software supply chain risk insights, and emerging threat trends that strengthen organizational resilience and support collective cyber defense.

Risk Governance, Executive Reporting & Regulatory Leadership

• Establish enterprise measurement strategy, KRIs, KPIs, exposure metrics, predictive analytics, executive dashboards, board-ready reporting, and regulatory evidence approaches for application security risk.
• Translate complex technical risk into executive-ready business narratives that support risk committees, audit committees, senior leaders, regulatory discussions, and investment decisions.
• Anticipate business, regulatory, technology, and threat landscape changes and recommend strategic improvements to products, processes, controls, services, and operating models.
• Serve as senior escalation authority for significant application security incidents, strategic risk decisions, complex remediation disputes, software supply chain events, and high-risk exceptions.

Enterprise Influence, Talent & Industry Leadership

• Lead multiple related teams by setting priorities, allocating resources, developing leaders, and aligning work to organizational objectives and annual plans.
• Represent the Application Security function in executive forums, regulatory interactions, audit discussions, industry forums, peer groups, and strategic vendor engagements.
• Champion secure-by-design, secure-by-default, developer enablement, automation, continuous validation, exposure management, and advanced security engineering practices across the enterprise.
• Build organizational capability through talent development, leadership coaching, technical communities of practice, standards, reference architectures, and knowledge-sharing forums.

Basic Qualifications

• Min 6 yrs of experience in Information Security, preferably in the Operations domain
• Min 4 years of Application Development (new)
• Min 4 yrs of experience in a Leadership role
• Associate's Degree

Preferred Qualifications

• 10 or more years of progressive experience across application security, cybersecurity, technology risk, secure software development, software assurance, or related technology disciplines, including leadership of managers or multiple teams.
• Recognized industry expertise in application security, secure SDLC, software assurance, DevSecOps, AI security, API security, cloud security, software supply chain security, security architecture, or cyber risk governance.
• Demonstrated success establishing enterprise strategies, operating models, governance frameworks, technical standards, measurement strategies, and measurable risk reduction outcomes.
• Deep expertise in OWASP, NIST SSDF, NIST CSF, CWE, CVSS, ATT&CK, AI security frameworks, cloud-native architectures, APIs, containers, Kubernetes, Infrastructure-as-Code, and secure software governance.
• Extensive experience advising executives, risk committees, audit committees, regulators, senior technology leaders, and business stakeholders on application security strategy, risk, and investment decisions.
• Experience leading programs supporting cloud transformation, digital modernization, mergers and acquisitions, developer security enablement, secure-by-design initiatives, software supply chain governance, and continuous security validation.
• Proven ability to solve complex operational and organizational problems by leveraging resources within and outside the department and persuading leaders to take action.
• Published thought leadership, conference participation, industry engagement, regulatory interaction, peer group leadership, or recognized cybersecurity community expertise strongly preferred.
• Advanced certification preferred, such as CISSP, CSSLP, CISM, CRISC, CCSP, OSWE, GWAPT, GWEB, GIAC, SABSA, AWS Security Specialty, Azure Security Engineer Expert, or equivalent recognized expertise.

Exempt Status

(Yes = not eligible for overtime pay) (No = eligible for overtime pay) Yes

Workplace Type

Remote

Our Approach to Office Workplace Type Certain positions outside our branch network may be eligible for a flexible work arrangement. We’re combining the best of both worlds: in-office and work from home. Our approach enables our teams to deepen connections, maintain a strong community, and do their best work. Remote roles will also have the opportunity to come together in our offices for moments that matter. Specific work arrangements will be provided by the hiring team.

Compensation

The compensation range represents the anticipated low and high end of the base compensation range for this position. Actual compensation will vary based on various factors including but not limited to location, experience, and education.Colleagues in this position are also eligible to participate in an applicable incentive compensation plan.

In addition, Huntington provides a variety of benefits to colleagues, including:

• health insurance coverage
• wellness program
• life and disability insurance
• retirement savings plan
• paid leave programs
• paid holidays
• paid time off (PTO)

Huntington is an Equal Opportunity Employer.

Tobacco-Free Hiring Practice: Visit Huntington's Career Web Site for more details.

Company Culture

Welcome to Huntington! At Huntington, we look out for people. From reinventing banking with game-changing innovations to building an internal culture that creates lifelong bonds, together, we can make people’s lives better. And amazing things happen when we look out for each other. We prove it every day. Whether it’s helping a colleague or collaborating on a new tool that will revolutionize the way people save money, our actions can have a huge impact. Our colleagues look out for people with a Can-Do Attitude, Service Heart and Forward Thinking. Those are our values—simple but powerful. Each of them pushes us do the right thing, to do right by people. Because people are what matter. If that sounds like you, we hope you’ll apply to join our team. If you’d like to learn more about how Huntington looks out for people, visit https://www.huntington.com/lookingout

Reasonable Accommodations

Reasonable Accommodations Reasonable Accommodations Various methods will be used throughout the recruitment process to verify candidate authenticity. Any interviews conducted virtually must be joined from a distraction-free environment, with the candidate on camera and without the use of virtual backgrounds. EEOC Disclaimer Know Your Rights CA Data Privacy CA Data Privacy Rights Tobacco Disclaimer Tobacco-Free Hiring Practice. Please send an email to [e-mail]