Principal Application Security Engineer (Director-Level Leadership)

🔐Principal AppSec Engineer (Director Level) | Remote, United States

Internal title: Director of Platform Security Engineering. We are advertising this opportunity as Principal AppSec Engineer (Director Level) to emphasize its deeply hands-on technical focus. This position combines senior Application Security expertise with people leadership and ownership of Pax8's Platform Security Engineering function.

Lead the future of Application Security at Pax8 by shaping how secure software is designed, built, tested, and delivered across our cloud-native platform ecosystem.

Build Security Into Everything We Create

At Pax8, security is not a checkpoint. It's a core part of how we innovate.

We're looking for a Director of Platform Security Engineering to lead our Application Security and Secure Software Development programs across the business. This role offers the opportunity to influence engineering strategy at scale, helping teams build secure products from the first line of code through deployment and operation.

As we continue our journey toward AI-enabled products, automation, and intelligent platform experiences, you'll play a critical role in ensuring security is embedded into every aspect of software delivery. You'll partner closely with engineering leaders, architects, and product teams to build secure-by-design practices that enable innovation rather than slow it down. You'll be responsible not only for Application Security, but also for helping define the security model for Pax8's emerging agentic AI systems, AI-assisted development workflows, and cloud platform security posture. This role owns the technical outcomes of the Platform Security Engineering function and serves as the final technical authority for Application Security across Pax8.

⚠ Important: This Is a Deeply Hands-On Application Security Leadership Role

This is not a traditional security management position.

The Director of Platform Security Engineering serves as Pax8's senior Application Security authority and is expected to remain actively engaged in the technical disciplines practiced by the team. While this role includes people leadership responsibilities, success requires current, hands-on Application Security expertise.

You should apply if you can confidently:

• Lead and facilitate threat modeling exercises.
• Review application architecture and secure design decisions.
• Read, critique, and discuss application code with engineers.
• Evaluate CI/CD pipeline security and software supply chain risks.
• Assess authentication and authorization designs, including OAuth 2.0, OIDC, token management, and delegated access models.
• Identify security flaws and vulnerability classes that others may miss.
• Act as the final technical escalation point for complex Application Security challenges.
• Personally lead threat models for high-risk systems and initiatives.
• Evaluate AI-powered systems and agentic workflows for authorization boundaries, prompt injection risks, tool access controls, and data exposure concerns.
• Validate the technical output of Application Security and Cloud Security engineers and establish engineering standards for the team.

This role is likely not a fit if your recent experience has been primarily focused on people leadership, governance, compliance, audit, risk management, or security program management without substantial hands-on Application Security practice.

Join a Company Transforming the Cloud Marketplace

Pax8 is redefining how technology is bought, sold, and managed. We empower Managed Service Providers with a modern marketplace that simplifies cloud adoption and accelerates business growth.

As our platform and product portfolio continue to evolve, we're investing heavily in engineering excellence, automation, artificial intelligence, and security engineering. This is an opportunity to join a high-growth technology company where your work will directly influence how millions of future transactions, integrations, and partner experiences are secured.

What You'll Do

🔐 Lead Application Security Strategy

• Define and execute the vision for Application Security, Product Security, and Secure Software Development across Pax8.
• Build long-term security roadmaps aligned to engineering objectives, business priorities, and risk appetite.
• Champion secure-by-design principles throughout the organization.
• Own the technical outcomes of the Platform Security Engineering program across five product domains with differing risk profiles and engineering models.
• Translate platform security strategy into specific engineering initiatives and measurable outcomes.
• Serve as Pax8's senior Application Security practitioner and technical authority.

🏗 Embed Security Into Engineering

• Partner with engineering leaders to integrate security directly into software development workflows.
• Drive adoption of secure coding standards, design reviews, threat modeling, and security architecture practices.
• Ensure security becomes a natural part of how teams build and iterate on products.

🚀 Advance Secure SDLC Maturity

• Establish scalable security engineering capabilities across the software development lifecycle.
• Drive implementation and optimization of application security tooling, including static analysis, dynamic analysis, software dependency scanning, container security, and API security solutions.
• Enhance automation that enables developers to identify and address security issues earlier in the development process.
• Own findings triage and vulnerability-management integration into engineering workflows.
• Define and maintain code-based security guardrails throughout the CI/CD pipeline.
• Ensure security controls are scalable, measurable, and developer-friendly.

🧩 Build Secure Products at Scale

• Oversee security reviews for cloud-native applications, microservices, APIs, and emerging AI-enabled capabilities.
• Guide teams through secure design decisions and product risk assessments.
• Improve vulnerability management and remediation programs across development teams.
• Own the security model for AI-enabled products, AI agents, and AI-assisted software development initiatives.
• Define authorization boundaries, tool access controls, and prompt-injection defenses for agentic systems.
• Collaborate with Engineering on safe adoption of AI technologies and secure architecture patterns.

📊 Measure What Matters

• Develop meaningful security engineering metrics that demonstrate program effectiveness and product security maturity.
• Use data, analytics, and insights to continuously improve security outcomes and developer adoption.

🌍 Develop High-Performing Teams

• Build, mentor, and empower a world-class team of security engineers and application security specialists.
• Foster a collaborative culture that balances engineering velocity with security excellence.
• Create opportunities for growth, innovation, and continuous learning.
• Own hiring strategy, interview design, and hiring standards for Security Engineering talent.
• Define the future structure, coverage model, disciplines, tooling strategy, and growth plan for the Platform Security Engineering organization.

⚡ Stay Ahead of Emerging Threats

• Evaluate evolving risks across software supply chains, cloud-native architectures, APIs, and AI-driven technologies.
• Lead security engineering responses to emerging vulnerabilities and threats.
• Drive adoption of modern security practices that strengthen resilience across the platform.

Your Impact

Your leadership will directly influence how Pax8 develops and delivers software. Success in this role means enabling engineering teams to move faster and more confidently while reducing product risk, strengthening customer trust, and building scalable security capabilities that support the future of the business.

What We're Looking For

• Current, hands-on Application Security expertise with the ability to serve as the senior technical authority for AppSec across the organization.
• Extensive experience (10+ years) leading Application Security, Product Security, or Security Engineering teams within modern software organizations.
• Proven success building and scaling Secure Software Development Lifecycle programs.
• Deep expertise in threat modeling, secure design reviews, software security testing, secure coding practices, and vulnerability management.
• Experience reviewing application architectures, software designs, and security controls at depth.
• Ability to personally lead threat-modeling exercises and security architecture reviews rather than solely reviewing team outputs.
• Hands-on experience implementing or governing SAST, DAST, SCA, IaC scanning, secrets management, CI/CD hardening, and software supply chain security controls.
• Demonstrated ability to serve as the final technical authority for Application Security decisions.
• Proven success influencing engineering organizations without direct reporting authority and maintaining security standards under sustained engineering pushback.
• Experience translating technical risk into executive-level narratives, prioritization decisions, and resourcing discussions.
• Strong understanding of modern authentication and authorization frameworks, including OAuth 2.0, OIDC, token-based authentication, and identity delegation patterns.
• Strong understanding of cloud-native applications, microservices architectures, APIs, containers, and modern software delivery pipelines.
• Demonstrated experience implementing and optimizing security tooling across application security and developer security ecosystems.
• Experience influencing engineering organizations and driving security adoption through partnership and enablement.
• Excellent communication skills with the ability to engage technical teams, executive stakeholders, and business leaders alike.
• A passion for developing security talent and building high-performing teams.
• A collaborative and pragmatic approach that enables innovation while reducing risk.

Preferred Qualifications

• Experience securing LLM-based, generative AI, or agentic AI systems.
• Experience governing AI-assisted software development and AI-generated code.
• Familiarity with OWASP SAMM, ASVS, or similar security maturity frameworks.
• Experience securing multi-tenant SaaS platforms with complex microservice architectures.
• Experience building and scaling distributed Application Security or Security Engineering teams.
• Proficiency in one or more programming languages such as Java, Python, Go, or JavaScript.

Education

• Bachelor's degree in a related field or equivalent professional experience.

Compensation- $220,000-$235,000/yr depending on experience and qualifications

Grow With Us

There's extensive room for a talented individual to grow at pace - whether that's advancing quickly in this role or exploring one of the many opportunities across our global organisation. You'll have access to our internal development hub designed to accelerate your skills and stretch your potential. Alongside specialist Learning & Development trainers, you'll also tap into AI powered tools, "born in the cloud" mentors, and cross continent collaboration that broaden your perspective and sharpen your expertise. We'll give you the space, trust, and the right projects to help you thrive - and full visibility of what it takes to reach your next level.

Perks:

At Pax8 we believe that your Total Rewards should include a benefits package that shows how much we value our greatest assets. All FTE