Application Security Manager

Application Security ManagerThis role has been designed as 'Hybrid' with a requirement that you will work on average 2 days per week from an HPE office.

Job Description:

About Our Cybersecurity Team

Are you ready to make an impact at one of the world's leading technology companies? HPE's Cybersecurity team is where you can do just that. We're looking for a dynamic and experienced Application Security Manager to join our team. If you're passionate about shaping the future of cybersecurity and ready for your next challenge, we'd love to hear from you.

About the Role

We're building a modern, enterprise Application Security program, and we're looking for a Manager to lead the engineers who run it day to day. This is a build-and-scale leadership role: the team is new, the strategy is set, and the toolchain is in place or rolling out. You'll turn that foundation into a high-performing team and a repeatable operating rhythm across Secure SDLC, web application and API protection, CI/CD pipeline security, SaaS security, and the emerging discipline of AI/LLM security.

Application security engineers will run the tools and do the technical work; you'll bring the technical depth to guide their decisions, review their approach, unblock them, and hold a high-quality bar. You'll work as one team with the US-based Application Security team, and partner closely with application owners, IT, and engineering teams to translate risk into outcomes developers adopt, so applications are secure by default.

What you’ll do:

• Lead and develop a growing team of 5–7 senior application security engineers based in Bangalore, India
• Hire, onboard, and develop a team of application security engineers; set clear goals, career paths, and a culture of ownership and technical excellence.
• Run day-to-day team operations: sprint planning, workload prioritization, on-call/escalation coverage, and vendor coordination.
• Provide technical direction and guidance to engineers: review triage decisions, tuning approaches, and remediation guidance, and step in on complex or escalated issues.
• Define team processes, runbooks, and RACI so work scales beyond individuals.
• Build and mature a scalable Application Security operating model with clear ownership, repeatable processes, measurable outcomes, and effective handoffs across Application Security, application owners, IT, and engineering teams.
• Work as an extension of the Application Security team, on aligning priorities, roadmap execution, standards, and shared operating processes across time zones.
• Establish strong working relationships with application owners and engineering leads
• Drive adoption of security controls by understanding application owners' delivery constraints and negotiating practical, risk-based remediation timelines.
• Manage the risk exception process with application owners, ensuring exceptions are documented, time-bound, and tracked.
• Oversee the team's operation of static application security testing (SAST), software composition analysis (SCA), secret scanning, and dynamic application security testing (DAST) across the application portfolio, ensuring effective tuning, triage, and developer enablement.
• Drive the threat modeling program, starting with business-critical, internet-facing applications handling Restricted or PII data.
• Establish and enforce risk-based vulnerability management SLAs aligned to application criticality tiers, and track remediation with application owners.
• Lead web application and API protection (WAAP) onboarding and operations across a large footprint of internet-facing applications using a phased, ring-based rollout, coordinating schedules and change windows with application owners.
• Ensure the team effectively manages policy tuning, false positives, origin protection, and incident support for web and API attacks.
• Oversee CI/CD security controls: pipeline hardening, secrets management, artifact integrity, and guardrails that don't slow delivery.
• Oversee open-source supply chain risk management, including malicious package detection and trusted package curation.
• Manage the SaaS Security Posture Management (SSPM) program for critical SaaS platforms, including coordination with managed service partners.
• Help stand up AI/LLM security practices: secure design guidance for AI-enabled applications, testing for prompt injection and data leakage, and governance for AI development tooling.
• Define and report program KPIs (coverage, mean time to remediate, risk burndown, adoption) to the Director and executive stakeholders.

First-Year Success Measures

• Build, onboard, and establish clear goals and career paths for a high-performing Application Security team.
• Establish and operationalize risk-based remediation SLAs across application criticality tiers.
• Meet agreed SAST, SCA, secret-scanning, and DAST coverage targets for business-critical applications.
• Complete and operationalize threat models for prioritized internet-facing applications handling Restricted or PII data.
• Complete agreed phases of WAAP onboarding across prioritized application portfolios.
• Establish executive KPI reporting for coverage, remediation performance, risk burndown, and control adoption.
• Launch initial AI application-security standards, review processes, and secure-design guidance.
• Establish the Application Security operating model, including ownership, RACI, escalation paths, and cross-team handoffs.

What you need to bring:

• 12+ years in information security, with at least 5 years focused on application security
• 4+ years managing security engineers.
• Strong technical depth across SAST, SCA, DAST, and secret scanning at enterprise scale, sufficient to guide engineers on tuning, triage, and signal-over-noise decisions.
• Strong understanding of web and API vulnerabilities (OWASP Top 10, OWASP API Top 10) and how they are remediated in code Working knowledge of CI/CD platforms (GitHub Actions, Jenkins, GitLab, or similar) and cloud-native environments (AWS, Azure, or GCP; containers; Kubernetes).
• Experience overseeing WAF/WAAP operations in production.
• Proven ability to build trusted relationships with application owners and influence engineering teams without direct authority, explaining risk in business terms.
• Experience working effectively with globally distributed teams and stakeholders across time zones.
• Builder mindset. You are energized by creating capabilities that do not yet exist. You can start with an ambiguous problem, shape a practical approach, and build teams, processes, and security capabilities that continue delivering measurable value beyond your direct involvement.

Preferred

• Experience building a team or program from the ground up.
• Familiarity with threat modeling methodologies (STRIDE, PASTA) and tooling.
• Exposure to AI/LLM security risks (OWASP Top 10 for LLM Applications, MITRE ATLAS).
• Experience with SSPM, and WAAP
• Certifications such as CSSLP, OSWE, GWAPT, CISSP

Accessibility

HPE is committed to creating an inclusive and accessible workplace and encourages applications from all qualified individuals, including those with disabilities. If you believe you require accommodation during any stage of the application or interview process, please submit your request by completing our secure form linked here.

Note: This option is reserved for applicants needing assistance/reasonable accommodation related to a disability.

Health & Wellbeing

We strive to provide our team members and their loved ones with a comprehensive suite of benefits that supports their physical, financial and emotional wellbeing.

Personal & Professional Development

We also invest in your career because the better you are, the better we all are. We have specific programs catered to helping you reach any career goals you have — whether you want to become a knowledge expert in your field or apply your skills to another division.

Unconditional Inclusion

We are unconditionally inclusive in the way we work and celebrate individual uniqueness. We know varied backgrounds are valued and succeed here. We have the flexibility to manage our work and personal needs. We make bold moves, together, and are a force for good.

#india#globalIT

Job:

Information Technology

Job Level:

Manager_1

Hewlett Packard Enterprise is EEO Protected Veteran/ Individual with Disabilities.

HPE will comply with all applicable laws related to employer use of arrest and conviction records, including laws requiring employers to consider for employment qualified applicants with criminal histories.

Recruitment Fraud Alert

We have become aware of an increase in fraudulent recruitment activities in which individuals impersonate our company or authorized recruitment agencies to offer fake employment opportunities. These scams may occur through false websites, emails, social media, or chat-based applications and often aim to obtain personal information or money. Please note that Hewlett Packard Enterprise (HPE), its direct and indirect subsidiaries and affiliated companies, and its authorized recruitment agencies/vendors will never charge a candidate a registration fee, hiring fee, or any other fee in connection with its recruitment and hiring process. We also never request personal information such as back account details, Social Security numbers, or national IDs via social media or chat applications.

All legitimate job opportunities will come through official company channels, and candidates are responsible for verifying the credentials of any third party claiming to represent the company. Any reliance on fraudulent communication is at the individual’s own risk, and HPE disclaims legal liability for any resulting damages. If you suspect recruitment fraud, do not share personal information or make any payments and report the incident to your local authorities immediately.