Global Application Security Lead

Lockton Companies; Overland Park (KS); Hybrid; USD 180,000 - 240,000; Full time

Job summary

Lockton Companies in Overland Park, Kansas seeks a Global Application Security Lead to own the day-to-day AppSec program across US, UK, MENA, and APAC. This hands-on leadership role manages the application security team, sets secure SDLC standards, and collaborates with the Global Enterprise Security Architect on strategy and delivery.

You will own the AppSec tooling estate (SAST, SCA, DAST, secrets scanning, IaC), perform threat modeling and internal testing, and drive remediation with

Qualifications

• Financial services, insurance, or other regulated industry experience.
• Experience with software supply chain security and dependency provenance controls.
• Experience defining controls for AI-assisted development tooling and AI-generated code review.
• Certifications such as OSWE, OSCP, GWAPT, CSSLP, or CISSP.

Responsibilities

• Execute the phased application security roadmap set by the Global Enterprise Security Architect, owning milestone delivery, dependencies, and status reporting.
• Operate the tiered application governance model (T1/T2/T3), including risk tiering intake, control expectations per tier, and periodic re-tiering of the application portfolio.
• Define and maintain secure SDLC standards, secure coding guidelines, and control gates at each stage of the development pipeline.
• Track and report AppSec operational metrics: scan coverage, finding volume by severity, mean time to remediate, SLA adherence, and exception backlog.
• Maintain the application security exception and risk acceptance register, escalating material risk to the Global Enterprise Security Architect.

Skills

Security leadership

Threat modelling

AppSec governance

Team management

Security tooling

Tools

SAST

SCA

DAST

Secrets scanning

IaC scanning

Job description

Overland Park, Kansas, United States of America

At Lockton, we’re passionate about helping our people achieve their ultimate potential. Our people are curious, action-oriented and always striving to make ourselves and those around us better. We’re active listeners working to ensure understanding and problem solvers developing innovative solutions. If you can see yourself delivering excellent service to clients, giving back to our communities and being a part of our caring culture, you belong here.

The Global Application Security Lead owns the day-to-day execution of the application security and DevSecOps program across all business units and regions. The role is responsible for the security controls embedded in the software development lifecycle, from secure design and threat modeling through static and composition analysis, dynamic testing, secrets management, and production hardening.

This is a hands-on technical leadership role with people management responsibility. The Lead manages the application security engineering team, sets the working standards that engineering teams follow, runs the AppSec tooling estate, and performs and directs application-level testing. Strategy, budget, and executive reporting sit with the Global Enterprise Security Architect; the Lead is accountable for delivery against that strategy, for the technical quality of the program, and for the performance and development of the team.

Position Details

• Reports To: Global Enterprise Security Architect, Security Architecture and Engineering (SA&E)
• Location: Kansas City, MO. In-office three days per week.
• Travel: Periodic travel to regional technology hubs.
• Coverage: Supports engineering teams across US, UK, MENA, and APAC time zones.
• Direct Reports: 2 application security engineers, plus technical direction of LGCC offshore engineering resources.

Core Responsibilities

Program Delivery

• Execute the phased application security roadmap set by the Global Enterprise Security Architect, owning milestone delivery, dependencies, and status reporting
• Operate the tiered application governance model (T1/T2/T3), including risk tiering intake, control expectations per tier, and periodic re-tiering of the application portfolio
• Define and maintain secure SDLC standards, secure coding guidelines, and control gates at each stage of the development pipeline
• Track and report AppSec operational metrics: scan coverage, finding volume by severity, mean time to remediate, SLA adherence, and exception backlog
• Maintain the application security exception and risk acceptance register, escalating material risk to the Global Enterprise Security Architect

Technical Ownership

• Own the AppSec tooling estate end to end: SAST, SCA, DAST, secrets scanning, and container and IaC scanning, including deployment, tuning, rule management, and pipeline integration
• Lead tooling proof of concept exercises, define evaluation criteria, run technical bake-offs, and produce recommendation documentation for architecture review
• Perform and direct internal application penetration testing, manual code review, and threat modeling on Tier 1 and high-risk applications
• Triage findings across all sources, validate exploitability, remove false positives, and drive remediation with owning engineering teams
• Manage third-party penetration test scoping, vendor coordination, finding validation, and retest closure
• Maintain and enforce guardrails for AI-assisted development, including approved AI coding tools, agentic tooling, MCP server usage, and dependency provenance controls addressing supply chain and slopsquatting risk

Team Leadership and People Management

• Build, lead, and develop the application security engineering team, including onshore staff and LGCC offshore engineering resources
• Own hiring for the function: role definition, interview loop design, candidate assessment, and onboarding
• Conduct performance reviews, set individual objectives, and manage performance concerns in partnership with HR
• Define career paths, technical skill matrices, and individual development plans for application security engineers
• Allocate work and manage team capacity against the program roadmap and inbound intake demand
• Provide technical mentorship on secure code review, exploitation technique, tooling operation, and finding write-up quality
• Provide input to headcount planning and offshore resourcing requests for review by the Global Enterprise Security Architect
• Define runbooks, playbooks, and repeatable procedures so that AppSec operations are not dependent on individual knowledge
• Manage day-to-day coordination and handoffs across US, UK, MENA, and APAC time zones

Cross-Functional Partnership

• Partner with Engineering, DevOps, Platform, and Product teams to embed controls into delivery workflows with minimal friction to release velocity
• Act as first-line technical escalation for application security findings, remediation disputes, and release blocking decisions, escalating unresolved risk decisions upward
• Support GRC and audit teams with evidence, control narratives, and testing artifacts for NYDFS 23 NYCRR 500, HITRUST, GDPR, and DORA obligations
• Support incident response for software-related incidents, including vulnerability triage, exploit analysis, and root cause contribution
• Translate technical findings into business impact for application owners and non-technical stakeholders

Security Champions and Culture

• Operate the Security Champions program within engineering teams, including champion selection, enablement content, and recurring working sessions
• Deliver secure coding training and targeted enablement based on observed defect patterns in the codebase
• Drive shift-left adoption so that security defects are found and fixed in development rather than at release gates

Qualifications

Preferred Qualifications

• Financial services, insurance, or other regulated industry experience
• Experience with software supply chain security, SBOM generation, and dependency provenance controls
• Experience defining controls for AI-assisted development tooling and AI-generated code review
• Certifications such as OSWE, OSCP, GWAPT, CSSLP, or CISSP

First 12 Months - Success Measures

• AppSec tooling deployed and integrated across 80% of Tier 1 and Tier 2 repositories with agreed scan coverage
• Risk tiering completed for the full application portfolio and control expectations published per tier
• Remediation SLAs defined, agreed with engineering leadership, and reported monthly
• Security Champions program operating with named champions in each major engineering group
• AI-assisted coding guardrails implemented and adoption measured across the developer population
• Team structure, role expectations, and individual development plans established for all direct reports

#LI-JM

Equal Opportunity Statement

Lockton Companies is proud to provide everyone anequal opportunity to grow and advance. We are committed to an inclusive culture and environment where our people, clients and communities are treated with respect and dignity.

At Lockton, supporting diversity, equity and inclusion is ingrained in our values, and we believe that we are at our best when we fully embrace everyone. We strive to cultivate a caring culture that learnsfrom, celebrates and thrives because of ourbreadth of differences. As such, we recognize that recruiting, developing and retaining people with diverse backgrounds and experiences is vital and enabling our people to thrive personally and professionally is critical to our long-term success.

About Lockton

Lockton is the largest privately held independent insurance brokerage in the world. Since 1966, our independence has allowed us to serve our clients, take care of our people and give back to our communities. As such, our 13,100+ Associates doing business in over 155 countries are empowered to do what’s right every day.

At Lockton, we believe in the power of all people. You belong at Lockton.

How We Will Support You

At Lockton, we empower you to be true to yourself in all that you do. Your success is our success, and we provide opportunities to help you grow and create a rewarding career path, however you envision it.

We are ready to meet you where you are today, and as your needs change over time. In addition to industry-leading health insurance, we offer additional options to support your overall health and wellbeing.