• Own and evolve the organization’s entire application security posture, with a focus on application and cloud security across all product lines • Perform offensive and defensive security assessments — threat modeling, code review, penetration testing, and vulnerability exploitation. • Build and integrate automated security tooling (SAST, DAST, dependency scanning, IaC scanning) into CI/CD pipelines • Develop security automation and internal tooling using Python, Bash, or Go. • Partner with Engineering, DevOps, and Infrastructure teams to ensure secure AWS architectures (VPC, IAM, KMS, GuardDuty, CloudTrail, WAF). • Oversee incident response and root cause analysis for product and infrastructure-level security events. • Define and enforce secure coding standards, and lead threat modeling sessions for critical features and services • Continuously hunt for vulnerabilities, test assumptions, and “break things safely” to strengthen the platform