Information Security Director - Application Security

The Opportunity
We are seeking a highly skilled and experienced Application Security Engineer Director to lead and oversee our organization's application security strategy and team. This leadership role will ensure that all software applications are designed, developed, and deployed securely, protecting sensitive data and minimizing risk. The Application Security Director will work closely with development, operations, and risk management teams to establish a security-first culture, implement robust security controls, and drive continuous improvement.
The Team
Our Application Security team is dedicated to ensuring the security of MassMutual software applications through rigorous assessments and proactive measures. While we collaborate closely with security architects, DevOps engineers, and software developers, our core team focuses on identifying & verifying vulnerabilities, implementing security best practices, and assisting teams in remediating their vulnerabilities. Our team brings various backgrounds and experiences spanning from software engineering to red teaming, valuing continuous learning, innovation, and collaboration.
The Impact:
Your key responsibilities will consist of the following to ensure applications are resilient against emerging threats, reducing potential financial and reputational damage from security incidents.

• Manage and develop a highly specialized application security engineers and managers, focusing on delivering moderate to complex services for cross-functional stakeholders and internal partners.
• Manage key strategic internal and external relationships across technical delivery of Application Security platforms and tools.
• In partnerships with architecture teams, develop strategy and manage delivery of engineering commitments (features, upgrades, scalability and reporting from tools etc.) aligned to application security strategic priorities and guide development of actionable roadmaps and plans.
• Proactively oversee and enhance "shift-left" agile goals, implementing automated controls early in the Software Development Lifecycle (SDLC).
• Collaborate and influence all levels of professionals including more experienced managers.
• Interface with external agencies, regulatory bodies, or industry forums.
• Develop and refine strategies for implementing application security controls within Lines of Business (LOBs) for improving developer experience and simplification of controls.
• Partner with application security practice areas for developing guidance on service execution, developer enablement, and remediation strategies etc.
• Partner with internal teams for end-to-end accountability of application security controls.
• Leverage reporting tools to demonstrate the overall risk through metrics (KPIs, KRIs, OKRs) of vulnerabilities and code defects to MassMutual's cyber assets for various team leaders and executive leadership for risk prioritization and enablement of risk-based decision-making.
• Stay up to date with the latest security threats, vulnerabilities, and industry trends to inform and improve security strategies.
• Strong problem-solving abilities and analytical thinking.
• Excellent communication skills to explain security issues to both technical and non-technical stakeholders.
• A team player with the ability to work in a collaborative, fast-paced environment.
• Manage strategic functional areas across application security, including but not limited to:
  • SAST/DAST/IAST/SCA
  • Application Security Posture Management (ASPM)
  • Secrets Management
  • Pen Testing
  • Fuzz Testing
  • Regression Testing for security
• Conduct assessments of applications using a range of manual and automated source code review techniques.
• Perform security architecture reviews and risk assessments for applications in design and production phases.
• Identify potential threats and attacks to application systems through threat modeling.
• Identify security recommendations and align them to appropriate risk ranking systems.
• Integrate application security tools and processes in pipeline.

The Minimum Qualifications

• Bachelor's in Computer Science, Information Security, or a related field.
• 8+ years of experience in application security, penetration testing, or secure software development.
• At least 1 of the following Security certifications such as OSCP, GWAPT, GWEB, CISSP, or CISM from an industry recognized certifier (e.g., SANS/GIAC, CompTIA, ISACA, ISC2, etc.)

The Ideal Qualifications

• Master's degree
• Manage projects, team members, and stakeholders for successful delivery.
• Strong knowledge of secure software development methodologies, including threat modeling, code reviews, and static/dynamic analysis.
• Experience with integrating security into DevOps (DevSecOps) and CI/CD environments.
• Strong technical knowledge of web application security, cloud security (AWS, Azure, GCP), mobile security, infrastructure as code (IaC), container security, and API security.
• Strong practical knowledge with SAST, DAST, and IAST tools.
• Deep understanding of common vulnerabilities (e.g., OWASP Top 10) and their mitigations.
• Advanced understanding and experience with source code (e.g., JavaScript, Java, C/C++/C#, Python, etc.) and familiarity with software security frameworks (e.g., Maven, Node, Gradle, etc.).
• Experience with identifying security vulnerabilities in dockers, containers, and Kubernetes.
• Experience with cloud deployment and automation tools (Terraform, GitHub Actions, Jenkins, AWS Cloud Formation Templates, Secrets Managers).
• Knowledge of compliance and regulatory frameworks (NYDFS, SOC 2, etc.).
• Experience in managing and delivering security tests and compliance review projects.

Core Values:

• Focus on the Customer: We understand our customers well and look for every opportunity to deliver an experience that is clear, easy, personal, human, empowering and trustworthy.
• Act with Integrity: We deliver on our promises by being open, honest, and humble and by adhering to the letter and spirit of applicable laws, rules, regulations, and company policies.
• Value People: We respect and learn from each other's diverse backgrounds, experiences, and ideas. We engage and develop people to their greatest potential.
• Work Collaboratively: We work together to achieve results by actively listening, seeking, understanding, and creating solutions as a unified team driving toward one company, one culture, and one brand.
• Achieve Results: We focus on winning by exceeding expectations and getting better - everyone, every day.

What to Expect as Part of MassMutual and the Team

• Regular meetings with leadership, application security team, development teams, solutions architects, etc.
• Focused one-on-one meetings with your team members and manager.

Access to mentorship opportunities

• Networking opportunities including access to Asian, Hispanic/Latinx, African American, women, LGBTQIA+, veteran and disability-focused Business Resource Groups
• Access to learning content on Degreed and other informational platforms
• Your ethics and integrity will be valued by a company with a strong and stable ethical business with industry leading pay and benefits

#LI-RK1
MassMutual is an Equal Employment Opportunity employer Minority/Female/Sexual Orientation/Gender Identity/Individual with Disability/Protected Veteran. We welcome all persons to apply. Note: Veterans are welcome to apply, regardless of their discharge status.
If you need an accommodation to complete the application process, please contact us and share the specifics of the assistance you need.
Salary Range: $148,300.00-$194,600.00