Senior Cloud & Application Security Strategist

AHEAD; United States; Ibrido; USD 250.000 - 300.000; Tempo pieno

Vantaggi offerti da questo lavoro

Medical, Dental, Vision Insurance

401(k)

Paid holidays

Paid time off

Parental and caregiver leave

Descrizione del lavoro

AHEAD is hiring a Principal Technical Consultant to lead security-focused engagements across cloud-native platforms. You will guide delivery teams, craft security delivery plans, and mentor engineers while shaping the practice and winning new work.

The role demands deep expertise in CNAPP tooling, cloud security, and DevSecOps, with strong communication and leadership across client delivery, business development, and thought leadership.

Competenze

• Undergraduate degree in Computer Science or Business Management preferred.
• Minimum of 3+ years of leadership experience.
• Professional certifications aligned to security portfolios are preferred (e.g. CISSP, CCSP, CSSLP, GIAC).
• Demonstrated experience establishing or maturing application security programs and mentoring engineers.

Mansioni

• Leads sessions of strategy, roadmap, design, and planning workshops for small to medium sized service engagements.
• Execute on project objectives, requirements gathering, milestones, timelines, to ensure engagements are delivered on time.
• Create and finalize project deliverables and perform peer review for collateral.
• Present deliverables effectively to project team members.
• Define and operationalize security delivery plans, including secure SDLC controls and risk-based prioritization.
• Lead application security and threat modeling workshops.

Conoscenze

Workshop facilitation

Project delivery

Executive reporting

Problem solving

Formazione

Bachelor's degree in CS or Business Management

Strumenti

Wiz CNAPP

ServiceNow

CI/CD pipelines

Terraform

Bicep

AWS CloudFormation

Docker

Kubernetes

SAST/DAST/SCA

Descrizione del lavoro

AHEAD builds platforms for digital business. By weaving together advances in cloud infrastructure, automation and analytics, and software delivery, we help enterprises deliver on the promise of digital transformation.

AtAHEAD, we prioritize creating a culture of belonging,where all perspectives and voices are represented, valued, respected, and heard. We create spaces to empower everyone to speak up, make change, and drive the culture at AHEAD.

We are an equal opportunity employer,anddo not discriminatebased onan individual's race, national origin, color, gender, gender identity, gender expression, sexual orientation, religion, age, disability, maritalstatus,or any other protected characteristic under applicable law, whether actual or perceived.

We embraceall candidatesthatwillcontribute to the diversification and enrichment of ideas andperspectives atAHEAD.

Principal Technical Consultants are seasoned experts in information security, cloud security, application securityandDevSecOps, threat management, and related technologies, with the ability to secure applications and APIs across the cloud-native software delivery lifecycle. Successful candidates support the Security team in Delivery, Business Development, and Practice Development.

Principal Technical Consultants collaborate with a diverse team of consultants with varying skills to meet and exceed client expectations through scoped engagements. They effectivelyfacilitateand lead client engagements remotely by guiding engagements toward scopedobjectivesand troubleshooting to effectively resolve project risks or issues. Principal Technical Consultants effectively lead client delivery engagements by executing the necessary project tasks, producing expected collateral, and presenting artifacts at any time throughout an engagement, while acting in a leadership capacity to the project team(s).

Principal Technical Consultants also support business development activities alongside a sales specialist to qualify client needs and expectations ordemonstratea capability or skillset. They may be directly engaged in client-facing interactions toidentifyclient needs and to produce and/or present sales proposals, leading client-visioning, or discovery sessions. Principal Technical Consultants may also collaborate with other AHEAD Practice areas toidentifycomplex, cross-practice solution sets to achieve a client’s desired state or outcome.

AHEAD Principal Technical Consultantsleveragetheir visibility and experience to contribute to the continuous improvement and maturation of in-practice service offerings and capabilities. This includesproposing ideas fornew offeringsand/orchangesto existing offerings or initiatives, as well astheircorrespondingGTM efforts.They are considered a technical leader within thepractice andexpected topositivelyimpacttheservicesportfolio and individuals on the team through thought leadership and mentorship.

Duties and Responsibilities

• The following are the expectations of a Principal Technical Consultant:

  Client Delivery

  • Leadsessions of strategy, roadmap, design, and planning workshops for small to medium sized service engagements

  • Execute on project/programobjectives, requirements gathering, project tasks/milestone, project status, dependencies, and timelines, to ensure engagements are delivered successfully and on time while meeting the business objectives

  • Creation and finalization of project deliverables, may perform peer review for collateral developed by others on a delivery team

  • Effective presentation of deliverables to project team members.

  • Knowledge of AHEAD’s project lifecycle management activities to effectively support delivery engagements throughout the duration of a project

  • Define and operationalize application security delivery plans, including secure SDLC controls, risk-based finding prioritization, developer enablement, metrics, and executive reporting.

  • Lead application security and threat modeling workshops covering secure architecture, abuse cases, application and API risks, and remediation planning.

  Technical Mastery

  • Proficiencyin technical troubleshooting; the ability to critically think about a problem and generate a creative solution with minimal oversight.

  • Deep knowledge of scripting, particularly with PowerShell and/or Python, and the ability to troubleshoot developed code.

  • Ability to triage andvalidateapplication security findings (SAST, DAST, SCA, secrets), distinguish exploitable issues from false positives, and recommend practical remediations.

  • Ability to effectively communicate aspects of a technical solution to a non-technical individual.

  • Capability to conduct research andutilizeavailable resources to fill in technical knowledge gaps where ambiguity presents itself.

  Business Development

  • Support business development pursuits through client discovery meetings

  • Represent service offerings during the sales cycle, including project scoping, proposal development, and presenting proposals to clients

  • Knowledge of AHEAD’s sales managementlifecycle to effectively support sales opportunities throughout the duration of a proposal

  • Lead client discovery and/or visioning workshops toidentifyopportunities for cross-practice collaboration

  • Familiarity with AHEAD’s enterprise service portfolio toidentifyopportunities for cross-practice collaboration

  Practice Development & Thought Leadership

  • Maintainsubject matterexpertisein a minimum ofeightsecurity domains or three security solutions

  • Participate in the development,enhancement, and standardizationof AHEADin-practiceserviceofferings

  • Owns and/or enables more than one service capability

  • Process-focusedtechnology thought leader and evangelist

  • Maintain a broad knowledge and understanding of current and future state IT trends, technologies, and standards

  • Lend supportand mentorship to others

Domain experience required

• Cloud Security Architecture & Risk Strategy

  • Proven experience in reviewing and implementing secure cloud reference architectures and landing zones.

  • Experience designing Zero Trust and network segmentation architectures for cloud environments, including micro-segmentation, private connectivity, and egress controls.

  • Ability to translate risk strategy by mapping traditional lift-and-shift approaches into cloud-native security controls.

  • Strong understanding of multi-cloud governance models, including Infrastructure-as-Code (IaC), policy-as-code (PaC), tagging standards, and multi-account strategies.

  • Experience operationalizing a secure cloud SDLC by embeddingIaCscanning, policy-as-code guardrails, and drift detection into multi-account and multi-cloud deployment pipelines.

  CNAPP Tooling

  • 5+ years of combined hands-on experience with CNAPP tools(Wizpreferred)

  • Expertise inintegratingCNAPPsolutionswith enterprise tooling such as ServiceNow, CI/CD pipelines, and ticketing/alerting workflows.

  • Experience extending CNAPP coverage into the SDLC byintegrating withsource repositories, CI/CD pipelines, and developer workflows to shift application security left.

  • Able toclearly and concisely communicateCNAPP(criticality, risk, remediation)to technical and business stakeholders.

  • Ability to unify application-layer findings (SAST, DAST, SCA, ASPM) with cloud posture and runtime context to prioritize remediation by real exploitability and business risk.

  • Strongtrack recordin deploying and instantiatingCNAPP solutions

  • Hands-on experienceleveragingthe application security and ASPM capabilities within CNAPP platforms — including code andIaCscanning, container image scanning,secretsdetection, and code-to-cloud traceability from source to running workload.

  Cloud Platforms & Native Security Controls

  • 5+ years of experience working with GCPandcloud-native services(AWS and Azureexperience optional)

  • Deep understanding and specialistexpertisewith cloud-native security services such as Google Security Command Center,AWSSecurityHub,and/orMicrosoftDefender forCloud).

  • Familiarity with securing managed cloud AI/ML services (e.g., Vertex AI, Amazon Bedrock, Azure OpenAI), including identity and access scoping, data protection, and guardrails.

  • Hands-on knowledge of cloud identity (IAM, Federation, RBAC) across multi-cloud environments.

  • Familiarity withIDaaSsolutions such as Okta and Entra ID.

  • Demonstrated experience with leadingsecurecloud migration projects/programs.

  Security Frameworks & Governance

  • Strong knowledge of security standards and frameworks:e.g.CIS Benchmarks, NIST, FedRAMP, ISO 27001, GDPR.

  • Ability to design and map cloud-specific controls for audit and compliance needs.

  • Experience with SIEM integration (Splunk, Sentinel, Chronicle) and cloud-native detection capabilities(optional).

  DevSecOpsand Application Security

  • Strong understanding ofDevSecOpsand secure coding bestpractices,including the ability to assess, implement, and mature application security programs against relevant industry frameworks and maturity models (e.g.OWASP SAMM, DSOMM)

  • Proficiencyin application threat modeling (e.g., STRIDE, abuse-caseand attack-surface analysis)conductedat design time and integrated into cloud-native andmicroservicesarchitectures.

  • Experience with reviewing and remediatinginsecureCI/CD pipelines

  • Experience with Application Security Posture Management (ASPM) and risk-based vulnerability prioritization — correlating and de-duplicating findings across SAST, DAST, and SCA and orchestrating remediation at scale.

  • Hands-on knowledge ofDevSecOpsand Application Security tooling, including DAST, SAST, SCA,secretsdetection, and related solutions.

  • Expertisein API security (REST andGraphQL), including the OWASP API Security Top 10, authentication/authorization and API gateway controls, and testing of APIs exposed by cloud-native and serverless workloads.

  • Ability to read, understand, and apply Infrastructure-as-Code (Terraform, Bicep, AWS CloudFormation).

  • Familiarity with policy-as-code tooling (OPA, Sentinel) andIaCscanning in CI/CD pipelines.

  • Proficiencyin scripting (Python, PowerShell, Bash) to automate security tasks.

  • Ability to perform secure code review and secure design/architecture reviews across common languages and frameworks, translating findings into actionable developer guidance.

  • Experience with containerization (Docker, Kubernetes) andsecuringworkloads at scale.

  • Experience securing the software supply chain, including SBOM generation and management, open-source and dependency risk governance, and artifact integrity and provenance (e.g., signing, SLSA).

Qualifications

• • Undergraduate degree in Computer Sciences or Business Management preferred,but notrequired

  • Minimum of

  • 3+years ofleadership experience

  • 10+ years consulting experience, orcommensuratework experience

  • Professional and/or technical certifications, including industry-recognized certifications which align to AHEAD’s Security service portfolioare preferred (e.g.CISSP, CCSP)

  • Application security certifications such asCSSLP, GIAC GWEB/GWAPT, OSCP, or equivalent are preferred.

  • Demonstrated experienceestablishingor maturing application security programs and mentoring engineers and security practitioners.

  • Excellentverbal and written communication skills

  • Comfortableaddressing groups of people in virtual or in-person settings

  • Demonstrated Business Acumen

  • Ability to solve complex, abstract problems

  • Excellent interpersonal skills, good listener, ability to connect with different personalities

  • Exhibit Executive presencewith leadership characteristics

  • Demonstrated experience as a technology change agent.

$250,000 - $300,000 a year

The compensation range indicated in this posting reflects the On-Target Earnings (“OTE”) for this role, which includes a base salary and any applicable target bonus amount. This OTE range may vary based on the candidate’s relevant experience, qualifications, and geographic location.

Why AHEAD:

Through our daily work and internal groups like Moving Women AHEAD and RISE AHEAD, we value and benefit from diversity of people, ideas, experience, and everything in between.

We fuel growth by stacking our office with top-notch technologies in a multi-million-dollar lab, by encouraging cross department training and development, sponsoring certifications and credentials for continued learning.

USA Employment Benefits include:

- Medical, Dental, and Vision Insurance

- 401(k)

- Paid company holidays

- Paid time off

- Paid parental and caregiver leave

- Plus more! See benefits https://www.aheadbenefits.com/ for additional details.

Use of AI:

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, assessing responses, or to capture recordings and create transcriptions or summaries during interviews. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans.

If you would like more information about how your data is processed, please refer to theCandidate Privacy Noticeor contact us [e-mail].

You may opt-out of the review or analysis of your application and resume by AI tools by using theGeneral Application. Please include the role you wish to apply for in the Additional Information field. You may also choose to opt-out of recording and transcription at any time, including after joining an interview. Candidates will not be penalized for choosing to opt-out.