Application Security Lead

Lead, Application Security, Cybersecurity, Grade 15.

As a Lead, you will be onsemi's technical leader for application security — responsible for securing the software we build, buy, and run across enterprise and manufacturing applications. You'll set the standards, do the deep technical work, and scale security through the engineering organization, including a network of Security Champions. It's a build‑and‑shape opportunity: you'll mature a secure‑by‑design program against a clear roadmap, and put modern AI‑assisted tooling to work to accelerate secure delivery — with human oversight. 

#L1-LK1

1. BE/ME in computer science, electronics, or a related technical field — or equivalent experience.
2. ~12+ years in software or information security, including demonstrated technical leadership of application‑security programs or initiatives (e.g., leading a champions network, mentoring engineers, driving cross‑team adoption).
3. Proven expertise in software security assessment, threat modeling, and secure architecture.
4. Strong grasp of OWASP Top 10, ASVS, SAMM, NIST SSDF, CWE, CVSS.
5. Hands‑on proficiency with SAST, DAST, and SCA integrated into CI/CD pipelines.
6. Experience with SBOM and software supply‑chain security.
7. Proficiency in Python scripting.
8. Ability to evaluate AI output for accuracy and manage AI‑specific risks (prompt injection, data leakage).
9. Strong written communication for technical documentation and risk reporting, and the ability to influence senior stakeholders.

1. Experience with cloud security (AWS, Azure, or GCP), containers/Kubernetes, and IaC scanning.
2. Hands‑on experience using LLMs / agentic AI for security work (code review, triage, remediation).
3. A second programming language (Java, C/C++, or JavaScript).
4. Experience building agentic DevSecOps / AI security‑testing workflows.
5. Exposure to ISO/SAE 21434, embedded, or semiconductor software security.
6. Experience coordinating vendors and multi‑site stakeholders.

1. Own the application‑security strategy, standards, and roadmap, aligned to NIST SSDF and OWASP SAMM, and translate them into practical governance (policies, IT‑GC change management, and a clear roles‑and‑responsibilities model).
2. Establish and scale a Security Champions program to embed secure coding, speed feedback loops, and drive remediation across teams.
3. Lead threat modeling, secure design/architecture reviews, code review, and security testing (SAST, DAST, SCA, penetration testing) across the SDLC and CI/CD.
4. Build secure build and secure deployment gates — integrating scanning into pipelines and defect tracking/SLAs into the release process.
5. Establish baseline security posture for applications and components (APIs, open‑source libraries, scripts, jobs) and drive shift‑left scanning in developer IDEs.
6. Stand up application security posture management (ASPM) and KPIs/metrics that give leadership visibility and guide investment.
7. Apply AI‑assisted and agentic security tooling to accelerate code review, triage, and fix generation — with human‑in‑the‑loop validation and controls for AI‑specific risks (prompt injection, data leakage, unsafe automation).
8. Strengthen software supply‑chain security, including SBOM and third‑party/open‑source risk.
9. Partner across R&D, IT, Manufacturing, and Product Security on requirements and risk, and communicate clearly to senior stakeholders.
10. Collaborating with the application teams/owner for remediation
11. Scaling the AI AppSec program