Strategic Application Security & DevSecOps Lead

Simpson Thacher & Bartlett LLP; New York (NY); On-site; USD 190,000 - 220,000; Full time

Job summary

The Senior Manager, Application Security at Simpson Thacher & Bartlett LLP will define, lead, and operationalize the firm’s application security program across internally developed applications, SaaS platforms, APIs, databases, generative AI platforms and emerging architectures.

They will partner with engineering, cloud and platform teams to embed security into the software development lifecycle while enabling teams to deliver securely at scale.

Qualifications

• 10+ years in application or product security engineering.
• Experience securing web apps, APIs, microservices and cloud-native workloads.
• Proven ability to lead enterprise security programs in large organizations.
• Experience integrating security into CI/CD and developer workflows.
• Strong threat modelling and secure design review experience.
• Excellent communication with executives and cross-functional teams.

Responsibilities

• Define and mature the enterprise application security strategy.
• Establish secure SDLC and DevSecOps standards.
• Integrate security controls into CI/CD pipelines and developer workflows.
• Lead, mentor, and develop security engineering teams.
• Provide security metrics and reporting to stakeholders.
• Partner with engineering, DevOps and platform teams to embed automated security testing.

Skills

Application security

Cloud-native security

DevSecOps

CI/CD security

SAST/DAST/SCA

Kubernetes security

Threat modelling

Leadership

Security automation

Python scripting

Education

Bachelor’s degree in information security or related

CISSP or CISM certification

Tools

SAST tools

DAST tools

SCA tools

API security testing

Container security tooling

Job description

The Senior Manager, Application Security at Simpson Thacher & Bartlett LLP will define, lead, and operationalize the firm’s application security program across internally developed applications, SaaS platforms, APIs, databases, generative AI platforms and emerging architectures.

They will partner with engineering, cloud and platform teams to embed security into the software development lifecycle while enabling teams to deliver securely at scale.