Job description

Description Summary: The Application Security Director provides leadership to managers and professional staff responsible for enterprise application security, secure development, software assurance, software supply chain security, cloud-native security, API security, and emerging technology risk. This role is accountable for the performance and results of multiple related teams, develops departmental plans and priorities, and serves as an industry expert and strategic advisor for enterprise application security risk management. Duties and Responsibilities: Enterprise Application Security Strategy Define and evolve the enterprise Application Security vision, strategy, operating model, governance framework, control objectives, and multi-year roadmap aligned to business, technology, and cybersecurity objectives. Provide leadership across managers, professional staff, and related teams responsible for application security testing, secure SDLC, software assurance, DevSecOps, API security, AI security, and software supply chain risk. Shape cybersecurity and technology strategy by influencing investment decisions, resource allocation, security architecture standards, platform direction, risk acceptance, and remediation priorities. Develop departmental plans, annual priorities, program objectives, staffing strategies, service models, and governance outcomes that improve application security maturity and enterprise resilience. Lead strategy for the organization’s most critical applications, digital platforms, cloud environments, customer-facing services, mergers and acquisitions, and emerging technology initiatives. Define and execute the enterprise vision for AI-enabled Application Security, integrating advanced analytics, automation, Generative AI, and secure-by-design principles throughout the SDLC to proactively identify, prioritize, report, remediate, and validate application security exposures while enabling secure innovation and reducing organizational risk. Lead strategic collaboration and information sharing across the financial services sector, serving as an active member of FS-ISAC and other trusted industry forums to exchange application security intelligence, secure development practices, software supply chain risk insights, and emerging threat trends that strengthen organizational resilience and support collective cyber defense. Risk Governance, Executive Reporting & Regulatory Leadership Establish enterprise measurement strategy, KRIs, KPIs, exposure metrics, predictive analytics, executive dashboards, board-ready reporting, and regulatory evidence approaches for application security risk. Translate complex technical risk into executive-ready business narratives that support risk committees, audit committees, senior leaders, regulatory discussions, and investment decisions. Anticipate business, regulatory, technology, and threat landscape changes and recommend strategic improvements to products, processes, controls, services, and operating models. Serve as senior escalation authority for significant application security incidents, strategic risk decisions, complex remediation disputes, software supply chain events, and high-risk exceptions. Enterprise Influence, Talent & Industry Leadership Lead multiple related teams by setting priorities, allocating resources, developing leaders, and aligning work to organizational objectives and annual plans. Represent the Application Security function in executive forums, regulatory interactions, audit discussions, industry forums, peer groups, and strategic vendor engagements. Champion secure-by-design, secure-by-default, developer enablement, automation, continuous validation, exposure management, and advanced security engineering practices across the enterprise. Build organizational capability through talent development, leadership coaching, technical communities of practice, standards, reference architectures, and knowledge-sharing forums. Basic Qualifications: Min 6 yrs of experience in Information Security, preferably in the Operations domain Min 4 years of Application Development (new) Min 4 yrs of experience in a Leadership role Associate s Degree Preferred Qualifications: 10 or more years of progressive experience across application security, cybersecurity, technology risk, secure software development, software assurance, or related technology disciplines, including leadership of managers or multiple teams. Recognized industry expertise in application security, secure SDLC, software assurance, DevSecOps, AI security, API security, cloud security, software supply chain security, security architecture, or cyber risk governance. Demonstrated success establishing enterprise strategies, operating models, governance frameworks, technical standards, measurement strategies, and measurable risk reduction outcomes. Deep expertise in OWASP, NIST SSDF, NIST CSF, CWE, CVSS, ATT&CK, AI security frameworks, cloud-native architectures, APIs, containers, Kubernetes, Infrastructure-as-Code, and secure software governance. Extensive experience advising executives, risk committees, audit committees, regulators, senior technology leaders, and business stakeholders on application security strategy, risk, and investment decisions. Experience leading programs supporting cloud transformation, digital modernization, mergers and acquisitions, developer security enablement, secure-by-design initiatives, software supply chain governance, and continuous security validation. Proven ability to solve complex operational and organizational problems by leveraging resources within and outside the department and persuading leaders to take action. Published thought leadership, conference participation, industry engagement, regulatory interaction, peer group leadership, or recognized cybersecurity community expertise strongly preferred. Advanced certification preferred, such as CISSP, CSSLP, CISM, CRISC, CCSP, OSWE, GWAPT, GWEB, GIAC, SABSA, AWS Security Specialty, Azure Security Engineer Expert, or equivalent recognized expertise. Exempt Status: (Yes not eligible for overtime pay) ( No eligible for overtime pay) Yes Workplace Type: Remote Our Approach to Office Workplace Type Certain positions outside our branch network may be eligible for a flexible work arrangement. We’re combining the best of both worlds: in-office and work from home. Our approach enables our teams to deepen connections, maintain a strong community, and do their best work. Remote roles will also have the opportunity to come together in our offices for moments that matter. Specific work arrangements will be provided by the hiring team. Compensation Range: The compensation range represents the anticipated low and high end of the base compensation range for this position. Actual compensation will vary based on various factors including but not limited to location, experience, and education.  Colleagues in this position are also eligible to participate in an applicable incentive compensation plan.  In addition, Huntington provides a variety of benefits to colleagues, including health insurance coverage, wellness program, life and disability insurance, retirement savings plan, paid leave programs, paid holidays and paid time off (PTO). Huntington is an Equal Opportunity Employer. Tobacco-Free Hiring Practice: Visit Huntington s Career Web Site for more details. Note to Agency Recruiters: Huntington will not pay a fee for any placement resulting from the receipt of an unsolicited resume. All unsolicited resumes sent to any Huntington colleagues, directly or indirectly, will be considered Huntington property. Recruiting agencies must have a valid, written and fully executed Master Service Agreement and Statement of Work for consideration.

Requirements

Must-haves

Enterprise Application Security Strategy
Define and evolve the enterprise Application Security vision, strategy, operating model, governance framework, control objectives, and multi-year roadmap aligned to business, technology, and cybersecurity objectives.
Shape cybersecurity and technology strategy by influencing investment decisions, resource allocation, security architecture standards, platform direction, risk acceptance, and remediation priorities.
Develop departmental plans, annual priorities, program objectives, staffing strategies, service models, and governance outcomes that improve application security maturity and enterprise resilience.
Lead strategy for the organization’s most critical applications, digital platforms, cloud environments, customer-facing services, mergers and acquisitions, and emerging technology initiatives.
Risk Governance, Executive Reporting & Regulatory Leadership
Establish enterprise measurement strategy, KRIs, KPIs, exposure metrics, predictive analytics, executive dashboards, board-ready reporting, and regulatory evidence approaches for application security risk.
Translate complex technical risk into executive-ready business narratives that support risk committees, audit committees, senior leaders, regulatory discussions, and investment decisions.
Anticipate business, regulatory, technology, and threat landscape changes and recommend strategic improvements to products, processes, controls, services, and operating models.
Serve as senior escalation authority for significant application security incidents, strategic risk decisions, complex remediation disputes, software supply chain events, and high-risk exceptions.
Enterprise Influence, Talent & Industry Leadership
Lead multiple related teams by setting priorities, allocating resources, developing leaders, and aligning work to organizational objectives and annual plans.
Represent the Application Security function in executive forums, regulatory interactions, audit discussions, industry forums, peer groups, and strategic vendor engagements.
Champion secure-by-design, secure-by-default, developer enablement, automation, continuous validation, exposure management, and advanced security engineering practices across the enterprise.
Build organizational capability through talent development, leadership coaching, technical communities of practice, standards, reference architectures, and knowledge-sharing forums.
Min 6 yrs of experience in Information Security, preferably in the Operations domain
Min 4 years of Application Development (new)

Nice-to-haves

Demonstrated success establishing enterprise strategies, operating models, governance frameworks, technical standards, measurement strategies, and measurable risk reduction outcomes.
Deep expertise in OWASP, NIST SSDF, NIST CSF, CWE, CVSS, ATT&CK, AI security frameworks, cloud-native architectures, APIs, containers, Kubernetes, Infrastructure-as-Code, and secure software governance.
Extensive experience advising executives, risk committees, audit committees, regulators, senior technology leaders, and business stakeholders on application security strategy, risk, and investment decisions.
Proven ability to solve complex operational and organizational problems by leveraging resources within and outside the department and persuading leaders to take action.
Published thought leadership, conference participation, industry engagement, regulatory interaction, peer group leadership, or recognized cybersecurity community expertise strongly preferred.
Advanced certification preferred, such as CISSP, CSSLP, CISM, CRISC, CCSP, OSWE, GWAPT, GWEB, GIAC, SABSA, AWS Security Specialty, Azure Security Engineer Expert, or equivalent recognized expertise.
Exempt Status: (Yes not eligible for overtime pay) ( No eligible for overtime pay)

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

apiaikubernetesawsazure

Platform: workday
Effort: long

Benefits

Benefits detected in the listing.

Health Insurance

Vision

Pto

Paid Time Off

Wellness