Application Security Group Lead

About Monday.com

monday.com is the AI work platform powering the most ambitious teams. 250,000+ customers across departments use us to bring people, workflows, and AI agents together on one flexible platform where AI doesn't just assist, it executes. We move fast, build things that matter, and foster an ownership-driven culture where you're empowered to shape how organizations work and outpace their competition.

About The Role

As our Application Security Group Lead, you will lead a group of talented security engineers, collaborating closely with Product, R&D and Internal Technology to embed security across every phase of the software development lifecycle (SDLC), CI/CD Security and Application Runtime Security in the era of agentic developer tools and environment. You will own the planning and execution of our global AppSec program, work with executives on strategic initiatives and drive a "secure-by-design" culture to ensure our agile deployment cycles never compromise on security.

Key Responsibilities

Strategic Leadership & Collaboration

• Meet and engage with technical leaders within monday for fostering a culture of security ownership across R&D and providing visibility to risks across different teams
• Define and execute a scalable application security roadmap aligned with monday.com’s rapid growth.
• Work with the leadership team of the Security department on collaboration, shared projects and support for the culture within the department
  
  

• Familiarity with utilization of AI in the development pipeline and overall application security risks in the AI stack
• Seamlessly integrate automated security testing (SAST, SCA, Secrets) into CI/CD pipelines.
• Lead the methodology for threat modeling sessions and architectural reviews for major platform changes, new features, and infrastructure updates.
• Oversee our bug bounty program, penetration testing, and internal vulnerability disclosures, ensuring timely, risk-based remediation.
• Partner with Governance, Risk, and Compliance (GRC) to ensure application compliance with application security related security controls as part of known frameworks (OWASP Top 10, ISO27001, SOC2, etc.)
  
  

• Mentor, scale, and inspire a high-performing team of AppSec engineers; encourage continuous learning and innovation.
• Act as a trusted advisor to product managers and engineering leads, balancing risk mitigation with business agility.
• Contribute to the branding and positioning of the Security department.
  
  

• 8+ years in application security, with at least 4 years managing AppSec teams in cloud/SaaS environments.
• Ability to see the bigger picture of monday’s product and system portfolio, prioritizing risks and activities.
• Strong communication skills, able to translate complex security concepts into actionable recommendations for developers and executives.
• Familiarity (preferably: hands-on experience) on mitigation against AI attack on product and application platforms (e.g. OWASP Top 10 for LLM)
• Strong background securing cloud-native applications (AWS preferable) and expertise with general web application vulnerabilities (e.g., OWASP Top 10, CWE).
• Proficiency in modern programming languages represented in our stack (e.g., Node.js, Ruby on Rails, React) and experience with Kubernetes, Docker.
• Track record of implementing and optimizing AppSec tools in DevOps pipelines (GitHub, CI/CD tools).