Practice Director - Application Security

AHEAD builds platforms for digital business. By weaving together advances in cloud infrastructure, automation and analytics, and software delivery, we help enterprises deliver on the promise of digital transformation.

At AHEAD, we prioritize creating a culture of belonging, where all perspectives and voices are represented, valued, respected, and heard. We create spaces to empower everyone to speak up, make change, and drive the culture at AHEAD. 

We are an equal opportunity employer, and do not discriminate based on an individual's race, national origin, color, gender, gender identity, gender expression, sexual orientation, religion, age, disability, marital status, or any other protected characteristic under applicable law, whether actual or perceived. 

We embrace all candidates that will contribute to the diversification and enrichment of ideas and perspectives at AHEAD. 

The Practice Director - Application Security leads the growth, performance, and ongoing development of AHEAD’s Application Security practice. This leader is accountable for building executive client relationships, creating and advancing sales opportunities, shaping services and go-to-market strategy, and developing a high-performing team. The role partners closely with AHEAD sales teams and other practices to bring clients integrated security solutions that address business and technology risk. 

The position is weighted approximately 70% toward sales and practice management and 30% toward delivery leadership. The Director brings deep expertise in application security, DevSecOps, cloud-native security, and secure software delivery, and applies that expertise to advise clients, differentiate AHEAD’s offerings, and ensure successful outcomes on selected strategic engagements. 

Role Allocation

• 70% — Sales and practice management: Revenue growth, pipeline development, client relationships, solution and proposal development, service portfolio and go-to-market leadership, team development, and practice operations. 

• 30% — Delivery leadership: Executive client advisory, engagement oversight, delivery quality, risk management, and selective hands-on or lead delivery for strategic engagements. 

Key Responsibilities

Sales and Practice Management — 70% 

• Build and execute the Application Security practice growth strategy, translating market needs and AHEAD priorities into a focused portfolio of services and go-to-market plans. 

• Develop trusted relationships with client executives and technology leaders; identify business priorities, security challenges, and opportunities to expand AHEAD’s impact. 

• Partner with sales specialists to qualify, shape, and advance opportunities from discovery through proposal, negotiation, and transition to delivery. 

• Lead client discovery, visioning, and solution-design sessions; communicate the business value, approach, scope, outcomes, assumptions, and investment for proposed services. 

• Own or contribute to opportunity plans, pipeline development, forecasts, and practice growth objectives in coordination with AHEAD sales and practice leadership. 

• Create, refine, and commercialize differentiated Application Security offerings, including new services related to AI Application Security and AI-DLC, as well as program assessments and roadmaps, secure SDLC and DevSecOps enablement, application and API security, threat modeling, ASPM, and software supply-chain security. 

• Drive new partnerships with industry-leading AI development and security technology partners. 

• Identify opportunities to combine Application Security services with cloud, infrastructure, data, AI, and other AHEAD capabilities to deliver integrated client outcomes. 

• Guide service positioning, packaging, repeatability, and supporting sales materials; ensure offerings remain aligned with client needs and current technology and market trends. 

• Build and develop the practice team through hiring, talent development, coaching, mentoring, and succession planning; foster collaboration across delivery and sales teams. 

• Direct practice capacity and resource planning in partnership with delivery leaders, balancing team capability, client demand, utilization, and quality. 

• Establish a culture of accountability, continuous improvement, knowledge sharing, and strong client service. Support consistent operating practices and financial performance for the practice. 

• Represent AHEAD through executive briefings, industry events, partner and client engagements, and thought leadership. 

Delivery Leadership — 30% 

• Provide executive oversight and delivery leadership for selected strategic or complex Application Security engagements, ensuring work meets agreed scope, quality, schedule, and business outcomes. 

• Lead or advise client strategy, roadmap, architecture, and planning workshops covering application security, secure software delivery, cloud-native applications, APIs, and risk prioritization. 

• Guide teams delivering application security program assessments and maturity improvements, secure SDLC controls, threat modeling, DevSecOps enablement, application and API security reviews, and remediation planning. 

• Ensure recommendations are practical and risk-based, translating technical findings into prioritized actions and clear business implications for technical teams and executive stakeholders. 

• Monitor engagement health, milestones, dependencies, risks, and client expectations; intervene to resolve issues and maintain delivery quality. 

• Review key deliverables and executive presentations, and coach engagement leaders and practitioners in client communication and delivery excellence. 

• Maintain a selective client-delivery role to stay close to client needs, validate service approaches, and bring delivery insight back into the practice portfolio. 

Technical and Market Expertise

The successful candidate brings credible, current expertise across Application Security and related cloud security disciplines, including: 

• Application security program strategy and maturity, secure SDLC, DevSecOps, and secure coding practices. 

• Application and API threat modeling, architecture and design review, and risk-based vulnerability prioritization. 

• Application Security Posture Management and the use of SAST, DAST, SCA, secrets detection, and related tooling to prioritize and coordinate remediation. 

• API security, including common REST and GraphQL risks, authentication and authorization patterns, and relevant OWASP guidance. 

• CI/CD and software supply-chain security, including dependency and open-source risk, SBOM practices, artifact integrity, and provenance. 

• Cloud-native application security and the relationship between code, infrastructure-as-code, containers, Kubernetes, runtime context, and cloud posture. 

• Security frameworks and maturity models relevant to application security, such as OWASP SAMM and DSOMM, and the ability to map technical controls to governance and compliance needs. 

• Relevant application security platforms and the broader security ecosystem, with the ability to evaluate technology in the context of client outcomes rather than a single vendor. 

Qualifications

• 15+ years of consulting or commensurate professional experience in information security, application security, cloud security, or a related field. 

• Significant leadership experience in a practice, program, business development, or consulting leadership role, including responsibility for developing people and influencing business outcomes. 

• Demonstrated success building client relationships and growing consulting opportunities, including leading discovery, solution shaping, scoping, proposal development, and executive presentations. 

• Experience developing or scaling professional services, security capabilities, or go-to-market offerings. 

• Demonstrated experience establishing, assessing, or maturing application security and DevSecOps programs. 

• Strong understanding of application and API security concepts, modern software delivery, cloud-native architectures, and the tools and practices used to secure them. 

• Ability to lead complex client engagements, manage executive stakeholders, and guide teams through ambiguity, competing priorities, and delivery risks. 

• Excellent written, verbal, presentation, facilitation, and relationship-building skills; comfortable communicating with technical practitioners and executive audiences. 

• Strong business acumen, strategic judgment, and ability to connect security investments to client objectives and measurable outcomes. 

• Undergraduate degree in Computer Science, Business Management, or a related field preferred, but not required. 

• Industry-recognized security certifications are preferred, such as CISSP, CCSP, CSSLP, or relevant GIAC certifications. 

The compensation range indicated in this posting reflects the On-Target Earnings (“OTE”) for this role, which includes a base salary and any applicable target bonus amount. This OTE range may vary based on the candidate’s relevant experience, qualifications, and geographic location.  

Why AHEAD:

Through our daily work and internal groups like Moving Women AHEAD and RISE AHEAD, we value and benefit from diversity of people, ideas, experience, and everything in between.

We fuel growth by stacking our office with top-notch technologies in a multi-million-dollar lab, by encouraging cross department training and development, sponsoring certifications and credentials for continued learning.

USA Employment Benefits include: 

- Medical, Dental, and Vision Insurance 

- 401(k) 

- Paid company holidays 

- Paid time off 

- Paid parental and caregiver leave 

- Plus more! See benefits https://www.aheadbenefits.com/ for additional details. 

Use of AI:

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, assessing responses, or to capture recordings and create transcriptions or summaries during interviews. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans.

If you would like more information about how your data is processed, please refer to the Candidate Privacy Notice or contact us at [email protected]. 

You may opt-out of the review or analysis of your application and resume by AI tools by using the General Application. Please include the role you wish to apply for in the Additional Information field. You may also choose to opt-out of recording and transcription at any time, including after joining an interview.  Candidates will not be penalized for choosing to opt-out.