Senior Manager, Application Security (Remote - EMEA, excluding France, Italy and Germany)

Candidates based in those three countries cannot be considered for this role. This is a senior leadership role in application security at a remote-first, global company that builds a widely used self-custody digital wallet and financial platform with users in roughly 190 countries. Because blockchain transactions are generally irreversible, a flaw in the product or its software delivery chain can cause direct financial loss for users, so the security function is held to a high bar. You will lead the application security team while staying close to hands-on code review and threat modelling.

What you'll do

• Lead and grow the application security team, including hiring, performance management and career development, while remaining technically involved.
• Set AppSec strategy, annual goals and quarterly OKRs, and track KPIs covering coverage, remediation and risk.
• Lead threat modelling and security design reviews across client applications, APIs, backend services, authentication, key management and signing.
• Define software supply chain controls for dependencies, builds, artefacts and releases, and work with engineering teams to implement and verify them.
• Own vulnerability triage, prioritisation and remediation tracking, and run bug bounty and penetration testing programmes, including external provider management.
• Define security standards for AI-assisted development and AI components, and provide evidence of controls for audits and customer due diligence.

What you need

• At least eight years in application security or security-focused software engineering, including at least two years leading people.
• Strong practical code review skills in TypeScript/JavaScript, Go or Solidity, with the ability to find vulnerabilities and help engineers fix them.
• Hands-on experience securing client applications and backend services, including distributed authentication, authorisation and key management.
• Practical experience with software supply chain security, such as dependency policies, software composition analysis, npm, artefact integrity and CI/CD.
• Working knowledge of EVM smart contract security, including upgrade and admin controls, and of assessing external audits.
• Clear written communication, from detailed threat models to concise risk summaries for executives. Must be based in EMEA, excluding France, Italy and Germany.

How to apply

Sign up free on i'llTip to see the employer's details and apply. i'llTip's AI can tailor your résumé to this job, and you'll get alerts for similar roles.