AppsFlyer

Application Security Team Lead

Herzliya · Work style not stated

Apply on the employer’s site ↗See how well you match this job

You apply directly with the employer. ROLIVA does not submit applications from this page and is not the employer.

About the role

Description from the employer’s posting. Check the employer’s page for the current version.

EmployerAppsFlyer
LocationHerzliya
Work styleWork style not stated
Employer posted1 day ago

AppsFlyer's Security team is looking for an experienced security leader to join us as an Application Security Team Lead. You'll lead a team of application security engineers and own how we secure our products, from design through code to production. You'll work closely with our R&D, DevOps and Product teams to build security into how we develop software, at scale.

The ideal candidate is a hands-on leader who is highly motivated, always eager to learn and has a 'can do' attitude. You'll play a pivotal role in protecting our products against security threats and vulnerabilities by combining technical depth, sound judgment and clear communication. You'll set the direction for application security at AppsFlyer, grow the people on your team, and balance strategic programs with hands-on technical work.

What you'll do

Lead, mentor and grow a team of application security engineers, with full people management responsibility, including hiring, goal setting, performance reviews and career development.
Own and evolve AppsFlyer's Secure SDLC (SSDLC) program, embedding security controls and standards across the development lifecycle.
Own the penetration testing program, covering internal testing, external vendor engagements, scoping, and follow-up on fixes.
Manage our bug bounty program, including triage, validation, severity rating, researcher communication, and driving fixes with R&D.
Drive code security at scale by owning SAST, SCA, secrets detection and secure code review practices.
Build security into our CI/CD pipelines, making security guardrails automated, reliable and developer-friendly.
Define and track application security KPIs, and report on risk posture and progress to Security leadership.
Partner with R&D leaders and cross-functional teams to prioritize and remediate vulnerabilities based on risk.
Take part in security incident response and lead post-incident reviews for application-related incidents.
Run secure development training and security champions programs for developers.
Stay current with emerging threats, vulnerabilities and industry best practices in application and product security.

Show full description

What you have

7+ years of experience in application security, penetration testing or product security, ideally in a SaaS company.
2+ years of experience managing security engineers.
Bachelor's degree in Computer Science, Information Security, or a related field.
Deep understanding of web and API security concepts and protocols (e.g., OWASP Top 10, OWASP API Top 10, SSL/TLS, OAuth/OIDC).
Hands-on experience with security testing tools such as Burp Suite, OWASP ZAP, or similar.
Proven experience building or running SSDLC programs, including SAST, DAST and SCA tooling and integrating it into CI/CD pipelines (e.g., GitHub Actions, Jenkins, GitLab CI).
Experience managing a bug bounty program (e.g., HackerOne, Bugcrowd) and working with external pentest vendors.
Experience with cloud security principles and best practices (e.g., AWS, GCP), containers and Kubernetes.
Excellent communication skills, with the ability to explain security risks and recommendations to technical and non-technical stakeholders as well as management.
Experience working with large-scale R&D environments.

Bonus Points

Hands-on coding experience (e.g., Python, Go, Java, Node.js).
Experience securing applications built on frontier AI models, including AI/LLM application security (e.g., OWASP Top 10 for LLMs).
Experience with agentic AI security and MCP security.
Security certifications such as OSCP, OSWE, or GWAPT.
Being introduced by an AppsFlyer team member.

See how well you match this job Apply on the employer’s site ↗

Check your resume against this job Free, no sign-up. Nothing you paste is stored.

Staying safe while you apply

Never pay to apply, interview or accept an offer. ROLIVA never asks you for payment to apply to a job.
Apply only through the official “Apply on the employer’s site” button, on the employer’s own site, and check that a recruiter’s email uses that employer’s own domain rather than a free email address.
Be cautious of an offer made with no real interview, or pressure to decide quickly or share financial details early.

Does something look wrong with this listing? Use “Report broken link” in the role details, or read ROLIVA’s full job-safety guidance ↗.

Preparing for this role with ROLIVA

Check the fit.
Compare the requirements with the experience you have confirmed, including gaps.
Prepare honestly.
Build interview stories and application drafts from your own evidence.
Keep track.
Save the role and record your own application status and follow-ups.

Create a free workspace or log in.