Security Practices Director

We are looking for a seasoned Security Practices Director with strong Application Security (AppSec) credentials to join our Professional Services team, leading security and compliance engagements that help customers maximize the value of their Salesforce investments — safely and at scale.

This role is primarily an AppSec expertise role; prior consulting/engagement management experience is a plus but not required — we'll support your growth into the client delivery and engagement-management aspects of the role.

What You'll Do

• Apply AppSec expertise (secure SDLC, vulnerability assessment, threat modeling, pen-test interpretation) to lead and validate technical security engagements for enterprise customers
• Identify and advise on common application vulnerabilities (OWASP Top 10, injection, broken access control, SSRF, insecure deserialization, etc.)
• Advise customers on how to securely implement and use SaaS platforms day-to-day — configuration hardening, access/identity management (SSO, MFA, OAuth), integration and API security, data protection, and ongoing operational security hygiene across the SaaS lifecycle
• Translate AppSec findings into prioritized, risk-based remediation roadmaps for client stakeholders
• Lead end-to-end delivery of security engagements — scoping, staffing, timeline, and risk ownership
• Partner with account teams and sales leadership on pre-sales — discovery, solution scoping, SOW development, and executive presentations
• Act as trusted advisor to C-suite and senior security stakeholders (CISO, CTO, VP of IT Security), translating technical risk into business terms
• Oversee delivery teams to ensure consistent methodology and quality across engagements
• Develop reusable delivery accelerators, methodologies, and playbooks grounded in AppSec best practice
• Mentor practice staff on both security substance and client-facing engagement skills

What We're Looking For

• 7–12+ years of AppSec experience (secure SDLC, vulnerability management, threat modeling, pen testing) — core, hands-on requirement
• Deep, working knowledge of the OWASP Top 10 and common application-layer vulnerability classes, and how to assess/mitigate them in practice
• Practical understanding of how to secure a SaaS platform through implementation and ongoing use — configuration hardening, IAM, API/integration security, and the shared-responsibility model, not just theoretical SaaS architecture
• Strong executive communication and presence; comfortable with CISO/CTO-level conversations
• Security certifications strongly preferred (CISSP, OSCP, or equivalent AppSec certs)

Nice to Have

• Familiarity with the Salesforce Platform (org architecture, sharing model, Shield, Data Cloud, Agentforce), including Salesforce-specific certifications
• Prior consulting/professional-services engagement management experience (scoping, client delivery ownership, SOW development)
• Experience with zero-trust architectures or CSPM in SaaS environments
• Big 4 or equivalent professional services tenure