DoubleVerify - Sr. Application Security Manager

• Application & Product Security • Own and evolve DV's application security program, including SAST, SCA, DAST, and Application Security Posture Management (ASPM) tooling (e.g., Ox Security) — advancing findings from non-blocking warnings toward enforced, risk-based merge gates. • Drive the OWASP Application Security Verification Standard (ASVS) adoption program across engineering repositories, including reporting, dashboards, and branch-level coverage. • Drive SBOM management, license compliance, and software supply chain security practices across development teams. • Partner with DevOps and engineering to embed security across the CI/CD pipeline and Secure SDLC (SSDLC). • Develop and maintain application security metrics and reporting for engineering leadership, including vulnerability burn-down and mean-time-to-remediate (MTTR). • Lead the bi-weekly vulnerability remediation touchpoints and the monthly Application Security Leadership Forums with engineering organizations (Pinnacle, Measurement, Programmatic, Architecture, Publisher, Social, QA, TechOps/SRE, CorpIT, DevOps, and M&A) to drive progress and accountability. • Oversee DV's API security program (OWASP API Security Top 10, e.g., Escape API Security) and attack surface management (ASM) capabilities, including discovery of shadow/zombie APIs. • Assist with Web Application Firewall (WAF) configuration, deployment, and monitoring. • Partner with DevOps/SRE on cloud and container security (e.g., Wiz) to deliver code-to-cloud coverage. • AI & Emerging Technology Security • Lead AI security governance, engineering, and threat assessment functions across DV's AI/ML ecosystem. • Secure AI agents, LLM-based applications, MCP gateway, and agentic SDLC workflows against threats such as prompt injection, jailbreaking, excessive agency, and supply chain compromise — including guardrails, telemetry, logging, and detections for developer AI tooling (Cursor, Claude Code, VS Code). • Evaluate and operationalize AI security platforms to provide detection, response, and AI supply chain governance across teams building or operating AI systems (e.g., AI security gateway, shadow-AI discovery/DLP, AI identity and software management). • Build threat models and controls for first- and third-party AI/ML workloads, including data pipelines, model provenance, and RAG architectures. • Advance AI-assisted security testing (e.g., DV's PromptFlow-driven web/API security test generation) to scale coverage across teams. • Security Engineering, Offensive Security & DevSecOps Enablement • Lead DV's offensive security and penetration testing program, working with external vendors and conducting internal security assessments. • Build and maintain security automation capabilities to reduce manual effort and increase detection coverage. • Partner with the DevOps and CloudOps organizations on cloud security (primarily GCP/Kubernetes), shared responsibility model execution, and infrastructure-as-code security. • Own and conduct threat modeling for DV products and infrastructure. • Deliver secure coding training and developer enablement programs across global engineering teams. • Team Leadership & Management • Recruit, onboard, and manage a team of security engineers and contractors, including software security developers and offensive security testers. • Set goals, track performance, and provide ongoing coaching and mentorship to team members. • Administer budgets, vendor relationships, and tool procurement within the security engineering function. • Collaborate cross-functionally with GRC, Security Operations, IT Security, Legal, and Privacy teams. • Meet with senior leadership, engineering managers, and developers across DV's global engineering departments on a regularly scheduled basis to share the security roadmap and best practices. • Represent the application security and AI security programs to senior leadership and in audit/compliance contexts (SOC 2, ISO 27001, NIST CSF 2.0).