Application Security Group Lead

About monday.com

monday.com is the AI work platform powering the most ambitious teams. 250,000+ customers across departments use us to bring people, workflows, and AI agents together on one flexible platform where AI doesn't just assist, it executes. We move fast, build things that matter, and foster an ownership-driven culture where you're empowered to shape how organizations work and outpace their competition.

About the Role

As our Application Security Group Lead, you will lead a group of talented security engineers, collaborating closely with Product, R&D and Internal Technology to embed security across every phase of the software development lifecycle (SDLC), CI/CD Security and Application Runtime Security in the era of agentic developer tools and environment. You will own the planning and execution of our global AppSec program, work with executives on strategic initiatives and drive a "secure-by-design" culture to ensure our agile deployment cycles never compromise on security.

Key Responsibilities

Strategic Leadership & Collaboration

Meet and engage with technical leaders within monday for fostering a culture of security ownership across R&D and providing visibility to risks across different teams

Define and execute a scalable application security roadmap aligned with monday.com’s rapid growth.

Work with the leadership team of the Security department on collaboration, shared projects and support for the culture within the department

Technical & Operational Oversight

Familiarity with utilization of AI in the development pipeline and overall application security risks in the AI stack

Seamlessly integrate automated security testing (SAST, SCA, Secrets) into CI/CD pipelines.

Lead the methodology for threat modeling sessions and architectural reviews for major platform changes, new features, and infrastructure updates.

Oversee our bug bounty program, penetration testing, and internal vulnerability disclosures, ensuring timely, risk-based remediation.

Partner with Governance, Risk, and Compliance (GRC) to ensure application compliance with application security related security controls as part of known frameworks (OWASP Top 10, ISO27001, SOC2, etc.)

People & Culture

Mentor, scale, and inspire a high-performing team of AppSec engineers; encourage continuous learning and innovation.

Act as a trusted advisor to product managers and engineering leads, balancing risk mitigation with business agility.

Contribute to the branding and positioning of the Security department.

Requirements

8+ years in application security, with at least 4 years managing AppSec teams in cloud/SaaS environments.

Ability to see the bigger picture of monday’s product and system portfolio, prioritizing risks and activities.

Strong communication skills, able to translate complex security concepts into actionable recommendations for developers and executives.

Familiarity (preferably: hands-on experience) on mitigation against AI attack on product and application platforms (e.g. OWASP Top 10 for LLM)

Strong background securing cloud-native applications (AWS preferable) and expertise with general web application vulnerabilities (e.g., OWASP Top 10, CWE).

Proficiency in modern programming languages represented in our stack (e.g., Node.js, Ruby on Rails, React) and experience with Kubernetes, Docker.

Track record of implementing and optimizing AppSec tools in DevOps pipelines (GitHub, CI/CD tools).

If you are passionate about creating secure, scalable technology and leading with vision and technical depth, we'd love to meet you!

About monday.com

monday.com is the AI work platform powering the most ambitious teams. 250,000+ customers across departments use us to bring people, workflows, and AI agents together on one flexible platform where AI doesn't just assist, it executes. We move fast, build things that matter, and foster an ownership-driven culture where you're empowered to shape how organizations work and outpace their competition.

About the Role

As our Application Security Group Lead, you will lead a group of talented security engineers, collaborating closely with Product, R&D and Internal Technology to embed security across every phase of the software development lifecycle (SDLC), CI/CD Security and Application Runtime Security in the era of agentic developer tools and environment. You will own the planning and execution of our global AppSec program, work with executives on strategic initiatives and drive a "secure-by-design" culture to ensure our agile deployment cycles never compromise on security.

Key Responsibilities

Strategic Leadership & Collaboration

Meet and engage with technical leaders within monday for fostering a culture of security ownership across R&D and providing visibility to risks across different teams

Define and execute a scalable application security roadmap aligned with monday.com’s rapid growth.

Work with the leadership team of the Security department on collaboration, shared projects and support for the culture within the department

Technical & Operational Oversight

Familiarity with utilization of AI in the development pipeline and overall application security risks in the AI stack

Seamlessly integrate automated security testing (SAST, SCA, Secrets) into CI/CD pipelines.

Lead the methodology for threat modeling sessions and architectural reviews for major platform changes, new features, and infrastructure updates.

Oversee our bug bounty program, penetration testing, and internal vulnerability disclosures, ensuring timely, risk-based remediation.

Partner with Governance, Risk, and Compliance (GRC) to ensure application compliance with application security related security controls as part of known frameworks (OWASP Top 10, ISO27001, SOC2, etc.)

People & Culture

Mentor, scale, and inspire a high-performing team of AppSec engineers; encourage continuous learning and innovation.

Act as a trusted advisor to product managers and engineering leads, balancing risk mitigation with business agility.

Contribute to the branding and positioning of the Security department.

Requirements

8+ years in application security, with at least 4 years managing AppSec teams in cloud/SaaS environments.

Ability to see the bigger picture of monday’s product and system portfolio, prioritizing risks and activities.

Strong communication skills, able to translate complex security concepts into actionable recommendations for developers and executives.

Familiarity (preferably: hands-on experience) on mitigation against AI attack on product and application platforms (e.g. OWASP Top 10 for LLM)

Strong background securing cloud-native applications (AWS preferable) and expertise with general web application vulnerabilities (e.g., OWASP Top 10, CWE).

Proficiency in modern programming languages represented in our stack (e.g., Node.js, Ruby on Rails, React) and experience with Kubernetes, Docker.

Track record of implementing and optimizing AppSec tools in DevOps pipelines (GitHub, CI/CD tools).

If you are passionate about creating secure, scalable technology and leading with vision and technical depth, we'd love to meet you!

Apply to this job
.css-15hql53{max-width: 800px;margin: 0 auto;padding: 0;}@media (max-width: 768px){.css-15hql53{padding: 0 16px;}}.css-15hql53 .form-section{margin-bottom: 20px;}.css-15hql53 .section-title{font-size: 1rem;font-weight: 600;color: #323338;margin-bottom: 8px;}.css-15hql53 .section-description{font-size: 0.875rem;color: #676879;margin-bottom: 12px;}.css-15hql53 .section-divider{border: none;height: 2px;background: linear-gradient(90deg,#e1e4e9 0%,#f1f3f5 50%,#e1e4e9 100%);margin: 40px 0;border-radius: 1px;}.css-15hql53 .form-field{margin-bottom: 16px;}.css-15hql53 .form-field label{display: block;font-size: 0.875rem;font-weight: 500;color: #323338;margin-bottom: 4px;}.css-15hql53 .form-field label.required::after{content: " *";color: #e44258;}.css-15hql53 .form-field .field-description{display: block;font-size: 0.75rem;color: #676879;margin-bottom: 4px;}.css-15hql53 .form-field .error-text{display: block;font-size: 0.75rem;color: #e44258;margin-top: 4px;}.css-15hql53 .ashby-input,.css-15hql53 .ashby-select{width: 100%;padding: 10px 12px;border: 1px solid #c5c7d0;border-radius: 8px;font-size: 0.875rem;color: #323338;background: #ffffff;outline: none;-webkit-transition: border-color 0.2s;transition: border-color 0.2s;}.css-15hql53 .ashby-input: focus,.css-15hql53 .ashby-select: focus{border-color: #009aff;}.css-15hql53 .ashby-input.has-error,.css-15hql53 .ashby-select.has-error{border-color: #e44258;}.css-15hql53 .ashby-textarea{resize: vertical;min-height: 80px;}.css-15hql53 .ashby-checkbox{width: 18px;height: 18px;cursor: pointer;}.css-15hql53 .ashby-file-input{font-size: 0.875rem;color: #323338;}.css-15hql53 .ashby-file-input.has-error{color: #e44258;}.css-15hql53 .submit-button{width: 100%;padding: 14px;background: #009aff;color: #ffffff;border: none;border-radius: 8px;font-size: 1rem;font-weight: 600;cursor: pointer;margin-top: 10px;margin-bottom: 24px;-webkit-transition: background 0.2s;transition: background 0.2s;}.css-15hql53 .submit-.css-15hql53 .submit-button: disabled{background: #c5c7d0;cursor: not-allowed;}.css-15hql53 .submit-error{color: #e44258;font-size: 0.875rem;margin-bottom: 10px;text-align: center;}.css-15hql53 .success-message{text-align: center;padding: 40px 20px;}.css-15hql53 .success-message h3{font-size: 1.5rem;font-weight: bold;color: #323338;margin-bottom: 12px;}.css-15hql53 .success-message p{font-size: 1rem;color: #676879;}.css-15hql53 .autofill-section{background: #f8f9fc;border: 2px dashed #d6dae5;border-radius: 12px;padding: 24px;margin-bottom: 24px;text-align: center;}.css-15hql53 .autofill-header h4{color: #323338;font-size: 1.125rem;font-weight: 600;margin-bottom: 8px;}.css-15hql53 .autofill-header p{color: #676879;font-size: 0.875rem;margin-bottom: 20px;}.css-15hql53 .autofill-upload-button{display: inline-block;background: #009aff;color: white;padding: 12px 24px;border-radius: 8px;font-weight: 500;cursor: pointer;-webkit-transition: all 0.2s ease;transition: all 0.2s ease;border: none;font-size: 1rem;}.css-15hql53 .autofill-upload-.css-15hql53 .autofill-upload-button.loading{background: #676879;cursor: not-allowed;-webkit-transform: none;-moz-transform: none;-ms-transform: none;transform: none;}.css-15hql53 .autofill-status{margin-top: 16px;display: -webkit-box;display: -webkit-flex;display: -ms-flexbox;display: flex;-webkit-flex-direction: column;-ms-flex-direction: column;flex-direction: column;-webkit-align-items: center;-webkit-box-align: center;-ms-flex-align: center;align-items: center;gap: 8px;}.css-15hql53 .autofill-status .status-success{color: #00ca72;font-weight: 500;font-size: 0.875rem;}.css-15hql53 .autofill-status .status-partial{color: #009aff;font-weight: 500;font-size: 0.875rem;}.css-15hql53 .autofill-status .status-error{color: #676879;font-weight: 500;font-size: 0.875rem;}.css-15hql53 .autofill-status .file-name{color: #676879;font-size: 0.8125rem;background: white;padding: 8px 12px;border-radius: 6px;border: 1px solid #d6dae5;}.css-15hql53 .privacy-divider{border: none;border-top: 1px solid #e1e4e9;margin: 24px 0 16px;}.css-15hql53 .privacy-notice{font-size: 0.875rem;color: #323338;margin-bottom: 16px;}.css-15hql53 .privacy-notice a{color: #323338;-webkit-text-decoration: underline;text-decoration: underline;}.css-15hql53 .privacy-notice .css-15hql53 .resume-field-populated .resume-file-status{display: -webkit-box;display: -webkit-flex;display: -ms-flexbox;display: flex;-webkit-align-items: center;-webkit-box-align: center;-ms-flex-align: center;align-items: center;gap: 12px;background: #f0f3ff;border: 1px solid #009aff;border-radius: 8px;padding: 12px 16px;}.css-15hql53 .resume-field-populated .resume-file-status .file-icon{font-size: 1.125rem;}.css-15hql53 .resume-field-populated .resume-file-status .file-name{-webkit-flex: 1;-ms-flex: 1;flex: 1;color: #323338;font-weight: 500;font-size: 0.875rem;}.css-15hql53 .resume-field-populated .resume-file-status .change-file-button{background: #009aff;color: white;border: none;padding: 8px 16px;border-radius: 6px;font-size: 0.8125rem;font-weight: 500;cursor: pointer;-webkit-transition: background 0.2s ease;transition: background 0.2s ease;}.css-15hql53 .resume-field-populated .resume-file-status .change-file-Autofill from Resume

Upload your resume to automatically fill in your application details

Choose Resume File
Basic Info
Name
Email
Resume
LinkedIn URL
Do you have the legal right to work in the country where this role is based, or would you require visa sponsorship from our company?
Select...
Authorized to work (No sponsorship required)
Requires visa sponsorship

Please review our privacy practices: Privacy policy: monday.com

Apply to this job