• Lead the Application Security team, including hiring, mentoring, and performance management. • Define and execute the Application Security roadmap aligned with business priorities and regulatory obligations (e.g., PCI, SOC 2). • Partner closely with Engineering, Product, QA, Infrastructure, and DevOps leadership to embed security early in the SDLC. • Oversee security design reviews and code security reviews across: Go-based microservices, Ruby-based monolith applications • Provide technical guidance on secure architecture decisions in a cloud-first (AWS) environment. • Own and continuously improve the organization’s threat modeling framework and ensure it’s embedded in new feature development and architectural changes. • Ensure SAST and SCA tooling is integrated into CI/CD and appropriately tuned to reduce false positives. • Drive meaningful reporting dashboards for Development and Engineering leadership. • Establish and operationalize a risk-based vulnerability prioritization framework and scoring rubric aligned with OWASP guidance and applicable industry standards. • Act as a trusted advisor to Engineering leadership and influence architectural decisions that reduce systemic risk.