Manager – Application and Data Security

Basic Function

HF Sinclair's Manager, Application and Data Security is the accountable leader for establishing and maturing the enterprise Application and Data Security function, owning the strategy, roadmap, tools, services, backlog, vendors, and measurable outcomes that protect applications, APIs, software dependencies, data, and AI-enabled solutions. The role applies Product Manager and Product Owner practices and allocates resources across application, data, and AI security on a fluid, risk-based basis.

This is a build-and-lead role for a small, hands-on team. The Manager provides technical leadership and contributes directly to testing, code review, tool configuration, and control implementation when needed. The role is the cybersecurity authority in DevSecOps and application delivery engagements but does not own DevSecOps, CI/CD operations, enterprise threat modeling, or cybersecurity policy governance.

Job Duties

• Build and lead the Application and Data Security capability, including its charter, operating model, service catalog, decision rights, and staffing.
• Serve on the Cyber Leadership Team and lead employees, contractors, and service providers as one integrated delivery capability.
• Develop business cases and budget requests; evaluate build, buy, and outsource options, including staff augmentation and AppSec-as-a-Service.
• Select and manage tools and providers, define statements of work and performance measures, and retain internal accountability for risk decisions and outcomes.

Application Security

• Define security requirements, control patterns, quality gates, and evidence expectations for internal, low-code, SaaS, third-party, API, open-source, Infrastructure-as-Code, container, and applicable OT applications.
• Own and operationalize application security tooling, including SAST, DAST, software composition analysis, SBOM, secrets scanning, and API and container security testing.
• Establish repeatable onboarding, risk tiering, security review, and vulnerability validation, and enable an Application Security Champions model using existing networks where practical.

Data Security

• Lead enterprise data security across on-premises, cloud, SaaS, application, analytics, and AI-enabled access paths.
• Complete and operationalize in-flight data discovery and classification, including sustainable ownership, coverage, and reporting.
• Direct implementation of monitoring, access governance, data loss prevention, Data Security Posture Management, and data-centric detection and response.

AI Security

• Provide application and data security input to the Securing AI Roadmap and execute assigned capabilities.
• Support evaluation of agentic AI, MCP, and AI-enabled tools, AI inventories, and security reviews of business AI use cases led by Architecture teams.
• Support AI red teaming and provide technical input to AI governance forums, policies, and standards.

Shared Operating Model

• Partner with Cybersecurity Architecture, Cyber GRC, and DevSecOps by supplying specialized expertise, technical requirements, tools, evidence, and integrated pipeline controls.
• Hold application owners accountable for remediation through transparent findings, severity criteria, targets, validation, and escalation.
• Partner with Security Operations and the MDR provider on triage and incident response, retaining Tier 3 and Tier 4 application, data, and AI expertise.
• Use existing GRC, Architecture Review Board, and Cyber Leadership Team processes for exceptions and material risk acceptance.

Roadmap, Delivery, and Outcomes

• Maintain an integrated multi-year roadmap and translate it into epics, acceptance criteria, and a prioritized backlog based on risk, criticality, dependencies, and capacity.
• Define minimum viable capabilities, pilots, implementation waves, and service transition requirements.
• Measure application coverage, gate adoption, vulnerability remediation, classification coverage, data exposure, and control effectiveness, focusing on risk reduction rather than tool deployment.
• Report posture, gaps, and investment tradeoffs to the CISO and governance forums, and adjust priorities based on findings and performance.

Special assignments or tasks assigned to the employee by their supervisor, as determined from time to time in their sole and complete discretion.

Experience

A minimum of 7 years of cybersecurity experience in application security, product security, software or data security, or related engineering responsibility.

Education Level

A minimum associate degree, or significant progress towards a bachelor’s degree.

Preferred Educatgion Level:

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Software Engineering, or a related field preferred; equivalent relevant experience will be considered.

Required Skills

• Strong understanding of secure software development, application architecture, APIs, cloud-native applications, software supply-chain risk, and CI/CD platforms.
• Hands-on ability to review code, interpret results, and tune tools such as SAST, DAST, software composition analysis, SBOM, secrets scanning, and API and container security.
• Knowledge of data discovery, classification, data loss prevention, and Data Security Posture Management across hybrid, cloud, and SaaS environments.
• Understanding of AI application risks, including agentic AI, MCP-enabled tools, prompt injection, and AI-related data loss.
• Ability to convert a capability vision into a roadmap, backlog, investment plan, and measurable outcomes using Product Manager and Product Owner practices.
• Experience developing business cases, managing budgets and vendors, and evaluating build, buy, and outsource options.
• Ability to influence technical and business stakeholders and balance strategic leadership with hands-on execution in ambiguous environments.

Preferred Skills:

• Experience establishing an AppSec-as-a-Service capability or managing an external application security provider.
• Experience securing AI-enabled applications, agentic workflows, analytics platforms, low-code development, or complex hybrid environments.
• Experience with SAFe, Agile Product Management, Product Owner practices, WSJF, OKRs, or other value-based prioritization methods.
• Preferred certifications include CISSP, CSSLP, GIAC Web Application Penetration Tester (GWAPT), or Certified Cloud Security Professional (CCSP), or equivalent demonstrated expertise.

Supervisory/Managerial Responsibility

Will lead a small team of employees, staff augmentation contractors, and third-party vendor support.

Work Conditions

Office-based with travel up to 5% by land or air is required. Driver based environment. Subject to all weather and varying road conditions. 

Benefits

HF Sinclair offers a comprehensive benefits package designed to support the well-being of our employees and their families. Our benefits include, but are not limited to, the following:

• Medical Insurance
• Vision Insurance
• Dental Insurance
• Paid Time-Off
• 401(k) Retirement Plan with match
• Educational Reimbursement
• Parental Bonding Time
• Employee Discounts

We are committed to fostering a supportive and inclusive work environment, ensuring our employees have the resources needed to thrive professionally and personally.

Benefit eligibility is governed by official plan documents, for more details visit Total Rewards.

Our One HF Sinclair Culture:

At HF Sinclair, we are united through our One HF Sinclair Culture, which is underpinned by our five core values of Safety, Integrity, Teamwork, Ownership and Inclusion. Developed to empower our people, our five core cultural values are at the heart of everything we do and extend to how we engage our stakeholders. These values influence our decisions, shape our behaviors and keep us connected across the entire organization.

We maintain a true Safety culture for our employees, communities, environments and customers. Our goal is to make sure everyone returns home safely each day. We have a long-standing commitment to Integrity and ethical behavior and do what is right for our employees, investors, communities and the environment. We encourage employees to Step Up and Stand Out by championing a culture of Teamwork and Ownership. We foster a culture of Inclusion by encouraging diversity of experiences, viewpoints and backgrounds. What makes each of us different, together makes us stronger.

About HF Sinclair Corporation

HF Sinclair Corporation, headquartered in Dallas, Texas, is an independent energy company that produces and markets high-value light products such as gasoline, diesel fuel, jet fuel, renewable diesel and lubricants and specialty products. HF Sinclair owns and operates refineries located in Kansas, Oklahoma, New Mexico, Wyoming, Washington and Utah. HF Sinclair provides petroleum product and crude oil transportation, terminalling, storage and throughput services to our refineries and the petroleum industry. HF Sinclair markets its refined products principally in the Southwest U.S., the Rocky Mountains extending into the Pacic Northwest and in other neighboring Plains states and supplies high quality fuels to more than 1,750 branded stations and licenses the use of the Sinclair brand to more than 350 additional locations throughout the country. HF Sinclair produces renewable diesel at two of its facilities in Wyoming and also at its facility in New Mexico. In addition, subsidiaries of HF Sinclair produce and market base oils and other specialized lubricants in the U.S., Canada and the Netherlands, and export products to more than 80 countries.

Equal Opportunity Employer

HF Sinclair Corporation is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status or any other prohibited ground of discrimination.