Application Security Lead

Are you an experienced application security professional ready to shape how security is built into software from the start? We’re looking for someone with a strong offensive security mindset who enjoys getting into the code, challenging real-world risk, and partnering with engineers to build secure and resilient applications, APIs and AI solutions.

As a proud Kiwi born and bred insurer, we pride ourselves on challenging the status quo and moving fast to make things happen. We’re here to create beautifully simple, rewarding experiences for our customers and communities, and we’re working hard to protect the future of Aotearoa.

At its heart, insurance is about helping people through the unexpected. Doing what’s right for our customers, especially in tough times, gives real purpose to our work.

Your day-to-day would look like

• Lead Tower’s Secure Software Development Lifecycle, embedding secure-by-design practices across how software is designed, built and released.
• Identify and validate security risks across applications, APIs and AI workloads, bringing an adversarial mindset to strengthen resilience.
• Partner closely with developers and engineering teams to embed practical security into delivery and build trusted, secure solutions.

In your first 6-12 months, success will look like:

• A clear application security vision is established, with secure-by-design practices embedded across engineering.
• SSDLC is embedded into delivery workflows, with effective security controls, gates and standards across GitHub and Jira Cloud.
• Security risks are identified and prioritised effectively, helping engineering teams focus on genuine vulnerabilities and appropriate remediation.
• Security capability is strengthened across engineering, with developers confident applying secure coding practices and security champions established across teams.

To thrive in this role, you’ll bring

• 5+ years’ hands-on application security experience, ideally across penetration testing, red teaming or secure software development, with a strong adversarial mindset.
• Strong software development and code-review capability, with proficiency in at least one of TypeScript/JavaScript, C#/.NET, Java or Kotlin.
• Practical experience across threat modelling, API security and secure CI/CD, including SAST, DAST, SCA and secret-scanning tools.
• Strong knowledge of modern security practices and frameworks, including OWASP Top 10, GenAI/LLM security and MITRE ATLAS.
• Experience partnering with engineering teams to remediate vulnerabilities, improve secure coding practices and influence security outcomes without formal authority.
• Exposure to AI/LLM security, security automation, Azure/Entra ID or Terraform is highly regarded, along with certifications such as OSCP, OSWE, GWAPT or CSSLP.

We invest in you.

We're serious about looking after our people. Along with a competitive salary, we offer a bunch of perks and benefits to support you and celebrate the work you do:

• 26 weeks of paid parental leave for the primary carer and 4 weeks for partners
• A paid day off on your birthday
• 22 days annual leave, plus two extra annual leave days and the option to buy up to eight more
• Wellness leave
• Career growth and internal progression opportunities
• Flexible working and a beautiful, modern office in Auckland
• Discounts on Tower insurance products
• Free life insurance

Ready to Apply?

If this sounds like your kind of role, we'd love to hear from you.

We're looking for someone who's excited to help shape a new era of insurance - someone who's ready to make a real impact. If that's you, send us your CV and a cover letter that shows us what you're all about.

We're reviewing applications as they come in - so don't wait too long. Apply now and let's chat.