Director of Application Security, Circle

• 12+ years in security engineering or application security, including 5+ years leading teams
• Deep expertise in at least two languages such as Java, Rust, Go, JavaScript, or Python
• Strong knowledge of secure cloud development on AWS, GCP, or Azure
• Proficiency in SDLC security tooling including SAST, DAST, and automated testing tools
• Experience implementing and auditing controls aligned with standards like OWASP, NIST CSF, or ISO 27001
• Ability to drive outcomes across cross-functional teams in high-growth environments
• Exceptional problem-solving, communication, and stakeholder management skills

Desirable

• As Director of Application Security, you will lead Circle’s efforts to ensure our Web 2.0 applications are built and maintained with the highest security standards
• You will drive the vision and execution of secure software development practices across the organization, partnering closely with engineering and product leaders
• You'll serve as a technical authority, assessing risks, guiding secure coding practices, and managing key stakeholder relationships
• Your leadership will be key to evolving our security posture through thoughtful education, proactive vulnerability management, and scalable security controls that support Circle’s growth and global scale
• Own the Web 2.0 application security strategy, roadmap, and execution at Circle
• Lead vulnerability management via bug bounty platforms, ensuring timely triage and resolution
• Collaborate with engineering teams to embed security into the development lifecycle of web, serverless, and service-based applications
• Assess security risks of new products and features in partnership with Product, Engineering, and Compliance
• Conduct source code reviews to evaluate the severity and reachability of vulnerabilities
• Recommend, implement, and validate security controls across Circle’s technology stack
• Cultivate relationships with key external stakeholders, including customers, vendors, and auditors
• Develop and deliver executive-level reporting on application security risks and program performance