Senior Application Security Manager

ABOUT PLEO Messy spend management is tricky business. And tedious processes are a lose-lose situation for all involved, not just finance. At Pleo, we're changing that. We build spend solutions that make managing money seamless, empowering, and surprisingly effective for finance teams and employees alike - with a vision to help all businesses ‘go beyond’. The word ‘Pleo’ actually means ‘more than you’d expect’, and living by that mantra has been the secret to our success over the last 10 years. Now, we’re at a pivotal moment in our journey; every move we make has a direct impact on our 40,000+ customers, our business, and our collective success. We need people who take pride in uncovering customer needs, who turn complex problems into simple solutions, challenge the way things are done (respectfully), and always aim high. With great ambitions driving us forward, we can’t say we’ve got this whole thing figured out. And frankly, that’s half the fun! What we can say is that we’re a driven, progressive, and, importantly, a kind bunch of 850+ people from over 100 nationalities, all committed to delivering the future of business spending, together. ABOUT THE ROLE We're looking for a Senior Application Security Manager to join our Cybersecurity team at Pleo. In this role, you'll own vulnerability management and set the long-term application security strategy, turning a growing stream of signal into a risk-ranked plan the engineering organisation can actually act on. If you're a player-coach who wants high leverage with low bureaucracy, and you'd rather mature a program than maintain one, then this is the opportunity for you! WHO YOU'LL BE WORKING WITH AND REPORTING TO You'll report to our VP of Fraud & Security and lead a small AppSec team with dotted lines to other security members. Your primary customers are Pleo's engineering squads, and your closest partners are DevSecOps, who feed you signal and automation, alongside SecOps, Risk & Compliance, Privacy, and Legal. Our team is highly collaborative and dedicated to keeping Pleo and its customers safe. You'll also have the chance to shape how the wider organisation thinks about security, well beyond your own team. WHAT YOU'LL BE DOING As a Senior Application Security Manager, you will: - Own vulnerability management end to end, covering reporting, triage, mitigation, and the long-term strategy for application security as a department. - Build a structured, risk-ranked approach to remediation, so the organisation knows what to fix first and why. - Establish clear, company-wide reporting on our vulnerability posture, giving leadership the data-driven visibility they need. - Set and deliver an AppSec roadmap, bringing delivery expectations and accountability to a team that hasn't had them. - Partner with engineering squads as customers rather than gatekeeping them, embedding proactive security processes into how they already work. - Multiply your team's impact through automation and AI, so coverage scales faster than headcount. - Grow and mentor engineers, coaching them toward staff-level capability and building their confidence along the way. - Support Pleo's compliance obligations across ISO27001, PCI-DSS, GDPR, and the regulatory expectations of each market we operate in, from a security vulnerability perspective. - Reduce our attack surface through technical controls, policy, and AI enablement, addressing both external threats and internal risk. - Contribute to the broader Cybersecurity team, staying connected with ongoing initiatives and helping shape our 2027 KPIs. WHAT YOU BRING You'll thrive in this role if you have: - 10+ years of experience steering application security and wider information security strategy in a compliance-heavy environment. - A background as a senior security engineer who moved into management, with enough technical depth that you're still credible and still hands-on. - A track record of mentoring and growing engineers, and of keeping a team accountable wi…