Director Application Security

We are seeking an experienced and visionary Director Application Security to lead the strategy, development, and execution of our Application Security program. Reporting to the Vice President of Security Operations, this leader will be responsible for maturing and optimizing application security capabilities across the software development lifecycle, ensuring secure-by-design principles are embedded into engineering practices while enabling rapid delivery of innovative products.

• Develop and execute the enterprise Application Security strategy aligned with business and technology objectives.

• Build and mature a scalable Application Security program supporting modern software development practices.

• Define the long-term roadmap for secure software development across cloud, web, mobile, APIs, and emerging technologies.

• Establish secure-by-design principles and integrate them throughout the Software Development Life Cycle (SDLC).

• Lead the implementation and continuous improvement of a Secure Software Development Lifecycle (SSDLC).

• Develop standards and security requirements for application development.

• Partner with engineering teams to integrate security early within CI/CD pipelines.

• Promote developer-friendly security practices that minimize friction while improving software security.

• Partner with DevOps teams to embed automated security controls into CI/CD pipelines.

• Improve automation of security testing and vulnerability management.

• Reduce developer burden through integrated tooling and streamlined workflows.

• Measure security effectiveness while enabling engineering velocity.

• Define CTEM scope around critical business services, crown-jewel applications, sensitive data, material APIs, and externally exposed assets.
• Consolidate exposure signals from application testing, attack-surface management, cloud security, vulnerability management, penetration testing, bug bounty, and threat intelligence.
• Establish a common exposure taxonomy and risk model that incorporates exploitability, reachability, business criticality, threat activity, and compensating controls.
• Maintain an evidence-backed view of application exposure rather than relying primarily on scanner severity.

• Build trusted relationships with engineering leadership.

• Champion security as an engineering quality function.

• Develop security champions programs across engineering organizations.

• Lead, mentor, and develop a high-performing Application Security team.

• Establish performance metrics and operational objectives.

• Manage vendor relationships and application security technologies.

• Support hiring and organizational growth as the program matures.

• Mentor developers on secure coding practices and emerging threats.

• Bachelor's degree in Computer Science, Cybersecurity, Engineering, or related field required.

• Advanced degree preferred.

The base salary range is $200,000 - $215,000 USD per year, total on target compensation includes a base salary plus a variable target incentive that aligns with individual and company performance.

As part of the application process, all applicants are required to take assessments. Western Union has partnered with a 3rd party provider to administer these tests. Applicants will need to provide their name and email address in order to process the assessments. If you have any questions, you may reach out to careers@westernunion.com.

We are passionate about honoring our employee's identity and fostering a feeling of belonging. Our commitment is to provide an inclusive culture that celebrates the unique backgrounds and perspectives of our global teams while reflecting the communities we serve. We do not discriminate based on race, color, national origin, religion, political affiliation, sex (including pregnancy), sexual orientation, gender identity, age, disability, marital status, or veteran status. The company will provide accommodation to applicants, including those with disabilities, during the recruitment process, following applicable laws.

Estimated Job Posting End Date:

This application window is a good-faith estimate of the time that this posting will remain open. This posting will be promptly updated if the deadline is extended or the role is filled.