Application Security Lead

Описание

Come join the company building the security operating model for the age of AI. AI has changed how data is used — and security must change with it. Cyera's mission is to empower businesses to accelerate AI Adoption by defining a holistic approach to securing AI - from data to access to model. Instead of perimeter controls and static policies, Cyera provides a unified control plane that understands relationships between data, access, and behaviors across humans, systems, and AI. This is a technical leadership role under Infrastructure, serving all of R&D and partnering closely with the Security organization, Product, and Engineering leadership. You'll start hands-on, with the mandate to build the function — and the team — around you.

Responsibilities

• Own product security end to end and be the trusted authority on Cyera's security posture for R&D leadership, the Security organization, and our customers — able to answer "how secure is our product?" with evidence
• Lead continuous adversarial validation of our code, infrastructure, and architecture, confirming the strength of authorization, tenant isolation, business logic, and every path to sensitive data
• Maintain a living map of Cyera's attack surface and sensitive data flows, and use it to focus assurance effort where the stakes are highest
• Run threat modeling and security architecture review for new services, integrations, cloud connectors, and multi-tenant components — early enough to shape the design
• Own multi-tenancy and customer data boundaries: tenant isolation, authorization logic, secrets and key handling, and the controls that keep every customer's data unreachable from any other
• Secure our AI and agentic surfaces — prompt injection, tool and agent authorization, and model and data boundaries for autonomous systems acting on customer data
• Lead red team exercises across production and pre-production, and run an internal bug bounty that puts Cyera engineers to work on our own code with real incentives and real follow-through
• Define risk management for our development and production environments: standards, severity models, security gates, and an exception process practical enough that teams follow it — and drive findings to verified, structural resolution
• Build the paved road for secure development: secure-by-default patterns and guardrails, SAST/DAST/SCA and secrets detection tuned so signal beats noise, and a security champions network across R&D
• Scale assurance through automation and self-service rather than headcount
• Keep the engineering organization exercised and incident-ready — tabletop drills, detection and forensic coverage in our own environments, escalation paths, and runbooks
• Represent product security externally, supporting customer security reviews, questionnaires, third-party penetration tests, and CISO-level conversations alongside the Security organization

Requirements

• 8+ years in application security or product security, including hands-on ownership of a security program
• Deep, current expertise in authentication and authorization, multi-tenant isolation, API and web security, cryptography and secrets management, software supply chain risk, and business logic vulnerabilities
• An attacker's mindset applied to systems you didn't build
• You can read unfamiliar code, form a hypothesis about how it breaks, and prove it — and you can scope and direct red team work against your own organization
• Threat modeling and security architecture review as a practiced discipline, ideally at a scale serving many engineering teams at once
• Strong engineering background: you write code (Python, Go, TypeScript, Java, or similar), understand distributed systems, and hold credible design discussions with senior engineers
• Cloud-native security depth in AWS, GCP, or Azure — IAM, network boundaries, Kubernetes, containers, CI/CD security, and infrastructure-as-code — and comfort working shoulder-to-shoulder with DevOps and Infrastructure engineers
• Experience embedding security across the development lifecycle from design through deployment, including secure SDLC processes and developer-facing tooling
• Technical leadership without authority: driving security outcomes across engineering teams through credibility, clarity, and prioritization
• Fluency in SOC 2, ISO 27001, or similar — enough to satisfy them efficiently, and the judgment to know where they stop
• The judgment to separate real risk from theoretical risk, and to say so plainly to engineers and executives alike

Nice to have

• Experience at a cybersecurity startup, especially one where the product itself was the trust boundary
• Experience at a cloud-native SaaS company operating a multi-tenant platform at scale
• Experience in high-consequence data environments — payments, financial services, crypto, or healthcare
• Offensive security background: penetration testing, vulnerability research, exploit development, published CVEs, or service in an elite technology unit
• Experience building or running a bug bounty program
• Security experience with AI/ML systems, LLM applications, or agentic architectures — including using AI to scale security review itself
• Experience securing data platforms or pipelines processing large volumes of sensitive data
• Experience hiring, mentoring, and growing security engineers
• Contributions to the security community: research, open-source tooling, writing, or talks

We offer

• Full-time employment