Head of AppSec & Secure SDLC (Remote)

Remote Worker LTD.; United States; Remote; USD 150,000 - 230,000; Full time

Job summary

MetaMask is seeking a Senior Manager, Application Security to lead security across extensions, mobile apps, Snaps, backend services, and smart contracts. You will set the strategy, lead a small senior team, review code, and perform threat modelling while collaborating with engineering leadership to manage risk and secure release pipelines.

The role covers architecture, dependencies, build controls, vulnerability disclosure, and AI security integration, requiring strong leadership and hands‑on

Qualifications

• Eight+ years in application security or software engineering with a security focus.
• Two+ years in people leadership and building AppSec programs.
• Strong code review skills in TypeScript/JavaScript, Go or Solidity.
• Experience securing applications across clients and backend services.
• Proven ability to run bug bounty or penetration testing programs.

Responsibilities

• Lead the Application Security team and define strategy, goals and KPIs.
• Oversee secure design across clients, APIs, and backend services.
• Define supply chain security requirements and validate controls.
• Lead security code reviews and threat modelling across systems.
• Integrate security testing into dev workflows and AI scanning.
• Own vulnerability management and external testing programs.
• Provide security expertise during incidents and audits.

Skills

Leadership

Code review

Threat modelling

APpSec strategy

Secure SDLC

Supply chain security

Vulnerability management

AI security scanning

Security testing

Team leadership

Tools

Git

Job description

MetaMask is seeking a Senior Manager, Application Security to lead security across extensions, mobile apps, Snaps, backend services, and smart contracts. You will set the strategy, lead a small senior team, review code, and perform threat modelling while collaborating with engineering leadership to manage risk and secure release pipelines.

The role covers architecture, dependencies, build controls, vulnerability disclosure, and AI security integration, requiring strong leadership and hands‑on