Team Lead, AppSec

📋 Description

• • Lead application and product security across Forward-built, third-party, and AI-built software.
• • Evolve the pentest program: aggressively security-test and remediate existing software, then continuously test net-new agents and the software agents create.
• • Proactively build and integrate AI solutions within the appsec function.
• • Own remediation workflows and vulnerability management with Engineering, including pre-production vs. post-production gap analysis.
• • Partner with other teams to build controls to contain external exposure: network allowlists, egress proxy, and proxy-level DLP.
• • Support the test-to-production review process so AI-built work is security-reviewed before promotion.
• • Grow and develop a team of senior engineers; set quality and coverage standards for offensive testing.
• • Build and maintain security services within the Forward application stack.
• • Why you should apply:
• • Shape a growing function: This is a high-visibility leadership role at a pivotal moment for Forward's security program.
• • Mission driven company: Forward is a trusted source of fast, flexible funding for small businesses that have often been underserved by traditional financing options.
• • Flexibility is a top priority: Our employees are empowered to choose where they want to work (whether that’s from home, in the office, or a combination of both) with flexible hours.
• • ROLE REQUIREMENTS:
• • Typically has 7 or more years in application security, offensive security, or product security, including team leadership.
• • Hands-on pentesting and code-review depth across web applications, APIs, and cloud infrastructure (AWS).
• • Experience building or scaling a security testing program — scoping, tooling, cadence, and remediation SLAs.
• • Understanding of AI/LLM attack surface: prompt injection, insecure agent tool use, and vulnerabilities characteristic of AI-generated code.
• • Experience with modern programming languages such as Ruby, Python, or Go, and with secure SDLC practices.
• • Ability to communicate risk and priorities crisply to engineers and executives.
• • Typically has a Bachelor's Degree in Computer Science or equivalent technical degree, or equivalent industry experience.
• • IT WOULD BE NICE IF YOU ALSO HAD:
• • Experience pentesting or red-teaming LLM applications and agentic systems.
• • OSCP/OSWE or comparable offensive certifications.
• • Experience running bug-bounty or external testing programs.
• • Background in fintech or other regulated environments.
• • COMPENSATION:
• • Annual Targeted Salary: $175,000– $200,000 USD
• • Annual Target Bonus: 12%