Director, Product Security

• Design, implement, and manage the end-to-end Product Security program
• Lead the adoption of DevSecOps practices, automating security tools and gates within the CI/CD pipelines
• Establish and enforce Secure Software Development Lifecycle (SSDLC) requirements
• Build, mentor, and manage a team of Product Security Engineers
• Proactively identify and establish security guardrails for AI/ML model development and usage
• Oversee the deployment, tuning, and management of application security testing tools (SAST, DAST, SCA)
• Lead vulnerability remediation efforts for all ACV products
• Perform and oversee deep-dive security architecture and design reviews for all new products, features, and core application services
• Define and manage secure configuration standards for containerized applications, microservices, APIs, and their supporting cloud infrastructure (AWS and GCP)
• Manage and coordinate external penetration testing and bug bounty programs
• Design, maintain, and measure processes to prevent vulnerabilities from reaching production
• Work with Technical Program Management to create appropriate key performance indicators
• Contribute to ACV’s overall Governance, Risk, and Compliance (GRC) program
• Lead security risk assessments, threat modeling, and tabletop exercises specific to product features and application architecture
• Ensure protection of sensitive data, including PII and financial information, within the application environment
• Serve as the primary security advisor to Product and Engineering leadership
• Collaborate effectively with IT, Engineering, and Product teams to integrate security into their processes
• Maintain strong communication channels with remote team members
• Create a culture of communication and collaboration
• Create and maintain executive dashboards to increase security visibility
• Perform additional duties as assigned

• 10+ years experience in Information Security
• 5+ years directly focused on Product Security or Application Security in a leadership role
• Proven experience building and leading a centralized Product Security/AppSec program within a technology-driven, cloud-based SaaS company
• Deep, hands-on knowledge of the Secure Software Development Lifecycle (SSDLC), CI/CD, and DevSecOps principles, including automating security tooling
• Strong understanding of security frameworks and best practices (NIST CSF, ISO 27001, CIS Controls)
• Extensive experience with cloud security, with a strong focus on securing applications deployed in AWS and/or GCP environments
• Experience with modern software development including Agentic and Generative AI techniques
• Expertise with multiple application security tools, including SAST, DAST, MAST, SCA, API security platforms, and Web Application Firewalls (WAF)
• Excellent communication, interpersonal, and leadership skills, with an ability to translate complex technical risks into business context
• Ability to work effectively in a remote environment and manage geographically dispersed teams

Experience with Fintech companies is desirable

• Multiple medical plans including a high deductible, low cost health plan
• Company-sponsored (paid) Short-Term Disability, Long-Term Disability, and Life Insurance
• Comprehensive optional benefits such as Dental, Vision, Supplemental Life/AD&D, Legal/ID Protection, and Accident and Critical Illness Insurance
• Generous paid time off options, including uncapped vacation days, paid sick days, 6 paid company holidays, 2 floating holidays, parental leave, bereavement leave, jury duty leave, voting leave
• Employee Stock Purchase Program with additional opportunities to earn stock in the Company
• Retirement planning through the Company’s 401(k)