Security Practices Director

Enboarder; Colorado; On-site; USD 180,000 - 240,000; Full time

Job summary

Enboarder seeks a seasoned Security Practices Director with strong AppSec credentials to lead security engagements for enterprise customers within our Professional Services team.

Role focuses on secure SDLC, vulnerability management, threat modeling, and risk-based remediation across SaaS platforms, with growth into client delivery and engagement management.

Qualifications

• 7–12+ years of AppSec experience including secure SDLC, vulnerability management, and threat modeling.
• Deep knowledge of OWASP Top 10 and common app vulnerabilities and mitigations.
• Experience securing SaaS platforms and advising customers on configurations, access control, and API security.
• Strong executive communication and ability to present risk to C-suite.

Responsibilities

• Lead and validate technical security engagements for enterprise customers.
• Identify and advise on common application vulnerabilities and mitigations.
• Advise customers on secure SaaS usage, IAM, API security, data protection, and security hygiene.
• Translate AppSec findings into prioritized remediation roadmaps for stakeholders.
• Lead end-to-end delivery of security engagements including scoping, staffing, and timelines.
• Collaborate with account teams on pre-sales discovery, scoping, SOW development, and exec presentations.
• Act as trusted advisor to CISO/CTO-level stakeholders and translate risk into business terms.
• Oversee delivery teams to ensure consistent methodology and quality.
• Develop reusable delivery accelerators and AppSec playbooks.
• Mentor practice staff in security substance and client-facing skills.

Skills

AppSec

Secure SDLC

Threat modeling

Vulnerability management

OWASP Top 10

SaaS security

Executive communication

Job description

We are looking for a seasoned Security Practices Director with strong Application Security (AppSec) credentials to join our Professional Services team, leading security and compliance engagements that help customers maximize the value of their Salesforce investments — safely and at scale. This role is primarily an AppSec expertise role; prior consulting/engagement management experience is a plus but not required — we'll support your growth into the client delivery and engagement-management aspects of the role.

What You’ll Do

• Apply AppSec expertise (secure SDLC, vulnerability assessment, threat modeling, pen-test interpretation) to lead and validate technical security engagements for enterprise customers
• Identify and advise on common application vulnerabilities (OWASP Top 10, injection, broken access control, SSRF, insecure deserialization, etc.)
• Advise customers on how to securely implement and use SaaS platforms day-to-day — configuration hardening, access/identity management (SSO, MFA, OAuth), integration and API security, data protection, and ongoing operational security hygiene across the SaaS lifecycle
• Translate AppSec findings into prioritized, risk-based remediation roadmaps for client stakeholders
• Lead end-to-end delivery of security engagements — scoping, staffing, timeline, and risk ownership
• Partner with account teams and sales leadership on pre-sales — discovery, solution scoping, SOW development, and executive presentations
• Act as trusted advisor to C-suite and senior security stakeholders (CISO, CTO, VP of IT Security), translating technical risk into business terms
• Oversee delivery teams to ensure consistent methodology and quality across engagements
• Develop reusable delivery accelerators, methodologies, and playbooks grounded in AppSec best practice
• Mentor practice staff on both security substance and client-facing engagement skills

What We’re Looking For

• 7–12+ years of AppSec experience (secure SDLC, vulnerability management, threat modeling, pen testing) — core, hands‑on requirement
• Deep, working knowledge of the OWASP Top 10 and common application-layer vulnerability classes, and how to assess/mitigate them in practice
• Practical understanding of how to secure a SaaS platform through implementation and ongoing use — configuration hardening, IAM, API/integration security, and the shared-responsibility model, not just theoretical SaaS architecture
• Strong executive communication and presence; comfortable with CISO/CTO-level conversations
• Security certifications strongly preferred (CISSP, OSCP, or equivalent AppSec certs)

Nice to Have

• Familiarity with the Salesforce Platform (org architecture, sharing model, Shield, Data Cloud, Agentforce), including Salesforce-specific certifications
• Prior consulting/professional‑services engagement management experience (scoping, client delivery ownership, SOW development)
• Experience with zero‑trust architectures or CSPM in SaaS environments
• Big 4 or equivalent professional services tenure