Head of AppSec

Salary: £61,000 - 101,000 per year

Requirements:

• We require a bachelors or masters degree in Computer Science, Cybersecurity, Information Technology, or a related field.
• We prefer relevant industry certifications such as CISSP, CISM, CSSLP, or AWS/Azure Security certifications.
• We need deep architectural fluency, with hands-on background in software engineering or secure architecture.
• We need comprehensive knowledge of both legacy on-premise infrastructure and modern cloud environments, including mainframe, monolithic apps, AWS, Azure, GCP, Kubernetes, and microservices.
• We need a proven track record of scaling modern AppSec tooling, API security gateways, CNAPP, and automated vulnerability orchestration pipelines.
• We need strong command of threat modeling methodologies such as STRIDE and PASTA.
• We need experience in cybersecurity, including a senior leadership role within a highly regulated, matrixed enterprise, ideally in global financial services.
• We need the ability to translate complex security metrics into business language for executive stakeholders while maintaining technical credibility with engineering teams.
• We need a pragmatic risk mindset and the ability to balance risk mitigation with business agility and speed-to-market.
• We need demonstrated success in building, mentoring, and inspiring globally distributed, high-performing engineering and security teams.

Responsibilities:

• We will transform our global AppSec function across multiple geographies.
• We will secure a hybrid technology estate ranging from core on-premises systems to modern cloud-native platforms while tackling enterprise tech debt.
• We will bridge the gap between engineering velocity and rigorous financial-grade security.
• We will orchestrate cross-functional collaboration across Cyber, CTO, CIO, and CRO organizations to embed security into our software delivery lifecycle.
• We will evolve traditional gatekeeping security practices into a developer-empowered, automated or autonomous DevSecOps model.
• We will formulate pragmatic, risk-based strategies to remediate vulnerabilities across legacy on-premise architectures and modern cloud environments.
• We will drive the strategy and implementation of modern Application Security Testing capabilities, including SAST, DAST, SCA, IAST, and Secrets Management.
• We will bring an engineering mindset to problem solving and build in-house solutions with speed and purpose.
• We will act as the central nexus between Cyber, CTO/CIO, and CRO functions.
• We will navigate a complex matrixed organizational structure to align priorities, secure executive buy-in, and drive accountability across global engineering teams.
• We will build a culture of security champions by fostering trust, providing continuous feedback loops, and delivering actionable remediation guidance.
• We will ensure our AppSec framework satisfies multi-jurisdictional compliance mandates.
• We will translate technical vulnerability data into executive-level risk metrics and communicate business impact to the CRO and operational risk committees.
• We will establish robust controls for managing supply chain security, open-source software dependencies, and third-party vendor components.

Technologies:

• API
• AWS
• Azure
• Cloud
• CTO
• DevSecOps
• GCP
• Kubernetes
• Nexus
• Security
• microservices
• Matrix

More:

We are HSBC, one of the largest banking and financial services organizations in the world, operating in 58 countries and territories. We aim to be where growth is, enabling businesses to thrive and economies to prosper while helping people fulfil their hopes and ambitions. This is a highly influential Head of AppSec role focused on transforming our global application security function across a hybrid technology estate. We offer a workplace that supports continuous professional development, flexible working, and opportunities to grow within an inclusive and diverse environment. We are an equal opportunity employer and consider applications based on merit and suitability to the role.

last updated 39 week of 2026