Manager, Application Security, DevSecOps

KPMG LLP; Chicago (IL); On-site; USD 140,000 - 190,000; Full time

Job summary

KPMG LLP in Chicago seeks a Manager, Application Security, DevSecOps to lead AI security initiatives within the Enterprise Security Services organization.

You will establish AI security standards and evaluation frameworks, own end-to-end AppSec assessments for AI tools, and embed AI AppSec requirements into DevSecOps, guiding secure‑by‑design practices across teams and executives.

Qualifications

• Minimum six years of recent experience in application security, DevSecOps practices, secure software engineering, and SDLC governance, including CI/CD pipelines and security tooling integration.
• Bachelor's degree preferred; minimum of a high school diploma or GED required; preferred certifications listed.
• Strong understanding of security standards and risk management within enterprise environments; Azure cloud knowledge preferred.

Responsibilities

• Establish, manage, and maintain AI‑specific application security standards, evaluation frameworks, and required security controls/baselines to address risks like data leakage, prompt injection, insecure agent actions, IP exposure, and supply‑chain threats
• Own the end‑to‑end AppSec evaluation process for AI tools and use cases, covering intake, architectural assessments, data flows, risk documentation, and formally accepted exceptions
• Act as the primary liaison between application teams and Information Security to embed AI AppSec requirements into DevSecOps processes and promote secure‑by‑design practices
• Provide security consulting and subject‑matter expertise to development and platform teams on secure AI design, integrations, operational models, and compensating controls
• Present AI AppSec evaluation findings, risk decisions, metrics, dashboards, and recommendations to both technical and executive stakeholders to track tool coverage and control maturity
• Maintain awareness of the emerging AI threat landscape while managing evaluation outcomes, approved tool lists, residual risks, and the consistent adoption of approved security controls
• Act with integrity, professionalism, and personal responsibility to uphold KPMG's respectful and courteous work environment

Skills

Application Security

DevSecOps

CI/CD Pipelines

Security Tooling

Cloud Security (Azure)

Technical Communication

Education

Bachelor's degree preferred

Certifications: CISSP, CISM, GWAPT, GPEN, CEH, GWEB

Tools

Azure Cloud

Security Tooling Integrations

CI/CD Tooling

Job description

KPMG is currently seeking a Manager, Application Security, DevSecOps to join our Enterprise Security Services organization.

Responsibilities:

• Establish, manage, and maintain AI‑specific application security standards, evaluation frameworks, and required security controls/baselines to address risks like data leakage, prompt injection, insecure agent actions, IP exposure, and supply‑chain threats
• Own the end‑to‑end AppSec evaluation process for AI tools and use cases, covering intake, architectural assessments, data flows, risk documentation, and formally accepted exceptions
• Act as the primary liaison between application teams and Information Security to embed AI AppSec requirements into DevSecOps processes and promote secure‑by‑design practices
• Provide security consulting and subject‑matter expertise to development and platform teams on secure AI design, integrations, operational models, and compensating controls
• Present AI AppSec evaluation findings, risk decisions, metrics, dashboards, and recommendations to both technical and executive stakeholders to track tool coverage and control maturity
• Maintain awareness of the emerging AI threat landscape while managing evaluation outcomes, approved tool lists, residual risks, and the consistent adoption of approved security controls
• Act with integrity, professionalism, and personal responsibility to uphold KPMG's respectful and courteous work environment

Qualifications:

• Minimum six years of recent experience in application security, DevSecOps practices, secure software engineering, and SDLC governance, including CI/CD pipelines and security tooling integration
• Bachelor's degree from an accredited college or university is preferred; minimum of a high school diploma or GED is required; the following preferred certifications: CISSP, CISM, GWAPT, GPEN, CEH, GWEB, or equivalent are preferred
• Strong understanding of application security principles, common security standards and frameworks (such as the OWASP Top 10 and secure coding standards), security controls, and risk management within enterprise environments
• Solid knowledge of AI‑related application security risks, including prompt injection, data leakage, IP protection, insecure automation, and third‑party AI supply‑chain risks
• Experience defining and enforcing security standards, baselines, and evaluation criteria for applications or platforms, with preferred experience with large global multi‑culture environments; moderate to expert knowledge of cloud platforms (with a preference for Azure), cloud security architecture, and secure service design
• Strong written and verbal English communication skills, with the ability to clearly articulate risk, evaluation outcomes, and security requirements to both technical and executive audiences.
• Applicants must be authorized to work in the U.S. without the need for employment‑based visa sponsorship now or in the future; KPMG LLP will not sponsor applicants for U.S. work visa status for this opportunity (no sponsorship is available for H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT or any other employment‑based visa)