Pleo is hiring a Senior Application Security Manager

Responsibilities

• Own vulnerability management end to end, covering reporting, triage, mitigation, and the long-term strategy for application security as a department.
• Build a structured, risk-ranked approach to remediation, so the organisation knows what to fix first and why.
• Establish clear, company-wide reporting on our vulnerability posture, giving leadership the data-driven visibility they need.
• Set and deliver an AppSec roadmap, bringing delivery expectations and accountability to a team that hasn't had them.
• Partner with engineering squads as customers rather than gatekeeping them, embedding proactive security processes into how they already work.
• Multiply your team's impact through automation and AI, so coverage scales faster than headcount.
• Grow and mentor engineers, coaching them toward staff-level capability and building their confidence along the way.
• Support Pleo's compliance obligations across ISO27001, PCI-DSS, GDPR, and the regulatory expectations of each market we operate in, from a security vulnerability perspective.
• Reduce our attack surface through technical controls, policy, and AI enablement, addressing both external threats and internal risk.
• Contribute to the broader Cybersecurity team, staying connected with ongoing initiatives and helping shape our 2027 KPIs.

Requirements

• 10+ years of experience steering application security and wider information security strategy in a compliance-heavy environment.
• A background as a senior security engineer who moved into management, with enough technical depth that you're still credible and still hands-on.
• A track record of mentoring and growing engineers, and of keeping a team accountable without micromanaging it.
• Demonstrated experience turning signal into prioritised action through risk-based triage.
• Experience using AI and automation to scale security coverage, rather than solving everything through headcount or process.
• The ability to shape culture outside your own team, influencing engineering squads without formal authority over them.
• Comfort in a fast-moving, complex, ever-evolving environment, where you're self-directed and proactive.

Nice to Have

• Exposure to fintech compliance requirements is a strong advantage.
• Backgrounds we also look at include DevSecOps and platform security leads with real AppSec depth.

Benefits

• Your own Pleo card (no more out-of-pocket spending!)
• Lunch is on us for your work days - enjoy catered meals or receive a lunch allowance based on your local office
• Comprehensive private healthcare - depending on your location, coverage options include Vitality, Alan or Médis
• We offer 25-28 days of holiday (depending on your location) + public holidays
• For our Team, we offer both hybrid and fully remote working options
• Option to purchase 5 additional days of holiday through a salary sacrifice
• We use MyndUp to give our employees access to free mental health and well-being support with great success so far
• Paid parental leave - we want to make sure that we're supportive of families and help you feel that you don't have to compromise your family due to work

Work Arrangement

Hybrid

Why is this role a good fit for you

This role is a good fit for you if: You want a fast, visible impact on a program with real room to improve, without having to fight for basic tooling and process first. You treat developers as customers and get satisfaction from security becoming an enabler rather than a blocker. You like being a player-coach, staying close to the technical work while growing the people around you. You're motivated by high leverage and low bureaucracy, and you'd rather build the system than personally do every task. This role is not a good fit for you if: You're looking to step away from technical work entirely at this level. You prefer to lead through mandate and process rather than partnership and example. You're sceptical of automation, AI, or of leaning on signal from partner teams.

How you'll develop in this role

In your first 6 months at Pleo, you'll: Get hands-on with Pleo's application security landscape, understanding our attack surface across payment systems and multi-region infrastructure, and forming your own view of where the real risk sits. Stand up clear vulnerability reporting and a risk-ranked remediation approach, and get key vulnerabilities patched proactively ahead of our next compliance audit. Build trust with engineering squads and start shifting the security culture, so teams come to you early rather than late. Integrate into the Cybersecurity team, connecting with DevSecOps, SecOps, and Risk & Compliance, and begin shaping the roadmap and KPIs that carry the program into 2027. By 12 months, the goal is a documented, repeatable security program with proactive threat monitoring in place, regulatory readiness for new markets, and a team that can scale. We're committed to helping you develop your career, whether that means taking on bigger projects, stepping into broader leadership, or acquiring new skills.

The interview process

We want to ensure you are set-up for success and understand what will be expected of you. If your application is successful, our interview process is as follows: Intro call: A 30-minute chat with our Talent Partner to discuss the role, your background, and how you feel about the player-coach shape of the job. Hiring Manager interview: a 60-minute conversation with our security management team, covering your AppSec depth, your evidence of maturing an existing program, and your partnership mindset. Technical interview: a 60-minute deep dive with our AppSec team on your hands-on application security expertise. Cross-functional interview: a 30-45 minute conversation with Privacy, Legal, and Risk & Compliance on how you work across those boundaries. Leadership interview: a 45-minute conversation on mentoring and growing engineers, and influencing without authority.

Additional Information

• English first. Since it's our company language, please submit your application in English. You’ll be using it a lot if you join us.
• We are unable to offer visa sponsorship for this role in any of the listed locations.