Director, Application Security
for section headings. Use - for any list of duties/requirements/benefits. Use
for prose.
We need to preserve ALL substantive information; do not invent or summarize away detail. So we need to keep details like responsibilities bullet points etc.
We need to extract responsibilities: Under Responsibilities heading there are subheadings: Leadership & Organizational Strategy, then bullet points under that, then "Represent Application Security at the executive and leadership level; translate complex technical risk into business impact for the VP Application Security Lead an AppSec organization..." Actually the text is messy. Let's parse.
Responsibilities section includes:
Leadership & Organizational Strategy
- Lead and develop a multi-manager organization across Application Security, and Security Architecture, setting clear direction, healthy team culture, and high-performance expectations at every level.
- Establish and execute a 2–3-year strategic roadmap for your domains that is tightly coupled to Zillow’s product and platform engineering priorities, not just industry compliance frameworks.
- Own workforce planning, org design, talent acquisition, and the development of a bench of future security leaders—with a specific focus on recruiting and retaining engineers who want to build, not just advise.
- Manage budget, tooling portfolio, and vendor relationships across your scope, with a bias toward consolidation, automation ROI, and eliminating tool sprawl.
- Represent Application Security at the executive and leadership level; translate complex technical risk into business impact for the VP Application Security Lead an AppSec organization that partners with product engineering rather than policing it—building “paved road” security capabilities embedded in CI/CD pipelines, frameworks, and developer tooling.
- Drive a developer-first security culture: create security enablement programs, secure coding training, and internal tooling that make the secure path the easy path for Zillow’s engineers.
- Ensure comprehensive coverage of Zillow’s application portfolio including secure design review, DAST/SAST integration, dependency management, and API security.
- Own product security strategy, ensuring that security is a design-time consideration in new product features, not an audit checkpoint at the end of the SDLC.
- Build and maintain a vulnerability management program with clear SLAs, risk-based prioritization, and executive-facing reporting.
Security Architecture
- Partner with the Security Architecture function to establish and maintain enterprise security patterns, reference architectures, and guardrails for Zillow’s cloud-native, AWS-centric infrastructure.
- Drive Zero Trust principles and identity-driven access across the environment, working with Platform Engineering to embed security patterns into infrastructure-as-code and platform primitives.
- Ensure security architecture is a proactive partner in platform and product design reviews, providing clear, opinionated guidance that accelerates rather than slows engineering delivery.
- Maintain a forward-looking architecture posture: evaluate emerging threats and technology shifts (e.g., AI/ML-driven attack surfaces, cloud configuration risk) and evolve controls accordingly.
Then after that there is a paragraph about Remote position and pay ranges.
Then "Who you are" qualifications list.
We need to preserve all that.
We'll create sections:
About the Team
with paragraph(s) from About The Team.
About the Role
with paragraph(s) from About The Role.
Responsibilities
with subheadings? The instruction says use for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It doesn't forbid using other headings inside? Probably we should only use those headings as top-level sections. Inside we can use
and
- . We could also use
for subheadings? Not specified; but we can just keep as paragraphs with bold? Better to keep as
with strong? But we must preserve info; we can keep subheadings as
Leadership & Organizational Strategy:
then list.
We'll do that.
Qualifications
for Who you are.
Compensation
for pay ranges and equity awards.
We might also include a Benefits
but we already have compensation includes equity. Could separate Benefits for equity awards. But instruction: prefer few sections. So combine pay and equity into Compensation.
We must not include Schedule.
We must not include Requirements/Skills if not present; we have Qualifications.
Now we need to strip boilerplate: Remove EEO etc. At end there is a lot of EEO statement, also Los Angeles County specifics, etc. Remove those.
Also remove "Get to know us" maybe? It's not boilerplate but could be considered marketing; but we could keep as part of About the Team? Actually we already have About The Team; the "Get to know us" is separate marketing about Zillow. Could be considered substantive about company; we could add a section "About Zillow". But we already have About the Team; maybe we can incorporate that content into About the Team? The About The Team paragraph is about the security team; the Get to know us is about Zillow overall. Could be separate section "About Zillow". However we want few sections; maybe we can merge into About the Team? But that would mix team description with company description; still okay. But we need to preserve all substantive info; merging is fine as long as we don't lose info. We'll add a paragraph after About The Team about Zillow.
Thus About the Team section will contain two paragraphs: first about the team, second about Zillow (Get to know us). Ensure we don't include the EEO etc.
Now we need to remove duplicated lines: there may be duplicate sentences; we need to check.
Let's extract About The Team text:
"About The Team Zillow’s Information Security team is the engineering-first security organization at the heart of one of the most-visited real estate platforms in the United States. We protect a product ecosystem that drives real estate transactions, safeguards the personal and financial data of millions of customers, and powers a marketplace that is reimagining what it means to come home. We operate like a product engineering team- we build, automate, and ship. Our security engineers are embedded partners to the product and platform organizations, not gatekeepers. We move fast, we prefer paved roads over guard rails, and we treat security as a feature of the product rather than a tax on it. Our work spans cloud-native infrastructure at scale, a high-velocity application development lifecycle, real-time threat detection and response, and a threat intelligence program that informs both defensive and product risk decisions across the company. This is a team where technical credibility matters. Our leaders write strategy documents and review detection logic and SDLC security controls. If you’ve spent your career building things - secure software, detection pipelines, AppSec programs, zero trust architectures -this is the kind of organization you’ve been building toward."
Now About The Role:
"About The Role As Director of Information Security, drive the strategy, execution, and maturity Application Security, and Security Architecture and our India Security Team. This is an M5 leadership role that reports directly to the VP, Information Security , and carries significant accountability for the security posture, talent, and engineering culture of a large, multi-function organization. We are looking for a builder, someone who has led application security organizations inside high-growth technology companies where engineering velocity is a first-class value. You have a background that started in software engineering or security engineering, and you’ve never fully left it behind. You are the leader who can earn trust with a senior engineers and peers, recruit principal-level security engineers, and then go present business risk. You will manage a team of managers and senior individual contributors across your four domains, partnering deeply with Platform Engineering, Product, Legal, Privacy, and Compliance. You will set multi-year technical roadmaps, own the operational budget and tooling strategy for your org, and serve as a key voice in defining the company’s overall security risk posture and investment priorities."
Now Responsibilities as extracted.
Now "Who you are" qualifications:
"Who you are 12+ years of progressive security experience, with at least 5 years in leadership roles managing managers and multi-functional security teams; prior experience in a high-growth consumer technology or fintech company is strongly preferred. Roots in security engineering, software development, or platform engineering—you have built things, not just governed them, and your technical instincts remain sharp enough to engage credibly with principal engineers and architects. Demonstrated experience owning multiple security domains simultaneously (e.g., SOC/detection, AppSec, architecture) with the organizational maturity to drive excellence across each without personally bottlenecking any of them. Proven track record in Application Security leadership at scale—specifically, building AppSec programs that integrate natively into SDLC, CI/CD, and developer workflows inside technology-forward organizations. Deep expertise in multi cloud security (AWS preferred), including IaC security (Terraform/CloudFormation), Kubernetes/container security, and Zero Trust architecture patterns. Strong detection engineering mindset: experience moving a SOC from alert triage to custom detection pipelines, SOAR automation, and threat-model-driven coverage. Ability to quantify and communicate security risk in business and financial terms; experience presenting to executive leadership and, ideally, board-level audiences. Talent magnet: a reputation for hiring and developing elite security engineers, with the technical credibility to attract senior ICs who could work anywhere. Familiarity with the modern security tooling ecosystem: SIEM, SOAR, DLP,EDR, EPM, CSPM/CWPP ,SaST /DaST. IAC, and container security - with the judgment to rationalize and consolidate rather than accumulate. Proficiency in at least one scripting or programming language (Python, Go, or similar); sufficient to review automation, detection logic, and security tooling code written by your team."
Now Compensation:
"This
for prose. We need to preserve ALL substantive information; do not invent or summarize away detail. So we need to keep details like responsibilities bullet points etc. We need to extract responsibilities: Under Responsibilities heading there are subheadings: Leadership & Organizational Strategy, then bullet points under that, then "Represent Application Security at the executive and leadership level; translate complex technical risk into business impact for the VP Application Security Lead an AppSec organization..." Actually the text is messy. Let's parse. Responsibilities section includes: Leadership & Organizational Strategy - Lead and develop a multi-manager organization across Application Security, and Security Architecture, setting clear direction, healthy team culture, and high-performance expectations at every level. - Establish and execute a 2–3-year strategic roadmap for your domains that is tightly coupled to Zillow’s product and platform engineering priorities, not just industry compliance frameworks. - Own workforce planning, org design, talent acquisition, and the development of a bench of future security leaders—with a specific focus on recruiting and retaining engineers who want to build, not just advise. - Manage budget, tooling portfolio, and vendor relationships across your scope, with a bias toward consolidation, automation ROI, and eliminating tool sprawl. - Represent Application Security at the executive and leadership level; translate complex technical risk into business impact for the VP Application Security Lead an AppSec organization that partners with product engineering rather than policing it—building “paved road” security capabilities embedded in CI/CD pipelines, frameworks, and developer tooling. - Drive a developer-first security culture: create security enablement programs, secure coding training, and internal tooling that make the secure path the easy path for Zillow’s engineers. - Ensure comprehensive coverage of Zillow’s application portfolio including secure design review, DAST/SAST integration, dependency management, and API security. - Own product security strategy, ensuring that security is a design-time consideration in new product features, not an audit checkpoint at the end of the SDLC. - Build and maintain a vulnerability management program with clear SLAs, risk-based prioritization, and executive-facing reporting. Security Architecture - Partner with the Security Architecture function to establish and maintain enterprise security patterns, reference architectures, and guardrails for Zillow’s cloud-native, AWS-centric infrastructure. - Drive Zero Trust principles and identity-driven access across the environment, working with Platform Engineering to embed security patterns into infrastructure-as-code and platform primitives. - Ensure security architecture is a proactive partner in platform and product design reviews, providing clear, opinionated guidance that accelerates rather than slows engineering delivery. - Maintain a forward-looking architecture posture: evaluate emerging threats and technology shifts (e.g., AI/ML-driven attack surfaces, cloud configuration risk) and evolve controls accordingly. Then after that there is a paragraph about Remote position and pay ranges. Then "Who you are" qualifications list. We need to preserve all that. We'll create sections:
About the Team
with paragraph(s) from About The Team.About the Role
with paragraph(s) from About The Role.Responsibilities
with subheadings? The instruction says usefor section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It doesn't forbid using other headings inside? Probably we should only use those headings as top-level sections. Inside we can use
and
- . We could also use
for subheadings? Not specified; but we can just keep as paragraphs with bold? Better to keep as
with strong? But we must preserve info; we can keep subheadings as
Leadership & Organizational Strategy:
then list. We'll do that.Qualifications
for Who you are.Compensation
for pay ranges and equity awards. We might also include aBenefits
but we already have compensation includes equity. Could separate Benefits for equity awards. But instruction: prefer few sections. So combine pay and equity into Compensation. We must not include Schedule. We must not include Requirements/Skills if not present; we have Qualifications. Now we need to strip boilerplate: Remove EEO etc. At end there is a lot of EEO statement, also Los Angeles County specifics, etc. Remove those. Also remove "Get to know us" maybe? It's not boilerplate but could be considered marketing; but we could keep as part of About the Team? Actually we already have About The Team; the "Get to know us" is separate marketing about Zillow. Could be considered substantive about company; we could add a section "About Zillow". But we already have About the Team; maybe we can incorporate that content into About the Team? The About The Team paragraph is about the security team; the Get to know us is about Zillow overall. Could be separate section "About Zillow". However we want few sections; maybe we can merge into About the Team? But that would mix team description with company description; still okay. But we need to preserve all substantive info; merging is fine as long as we don't lose info. We'll add a paragraph after About The Team about Zillow. Thus About the Team section will contain two paragraphs: first about the team, second about Zillow (Get to know us). Ensure we don't include the EEO etc. Now we need to remove duplicated lines: there may be duplicate sentences; we need to check. Let's extract About The Team text: "About The Team Zillow’s Information Security team is the engineering-first security organization at the heart of one of the most-visited real estate platforms in the United States. We protect a product ecosystem that drives real estate transactions, safeguards the personal and financial data of millions of customers, and powers a marketplace that is reimagining what it means to come home. We operate like a product engineering team- we build, automate, and ship. Our security engineers are embedded partners to the product and platform organizations, not gatekeepers. We move fast, we prefer paved roads over guard rails, and we treat security as a feature of the product rather than a tax on it. Our work spans cloud-native infrastructure at scale, a high-velocity application development lifecycle, real-time threat detection and response, and a threat intelligence program that informs both defensive and product risk decisions across the company. This is a team where technical credibility matters. Our leaders write strategy documents and review detection logic and SDLC security controls. If you’ve spent your career building things - secure software, detection pipelines, AppSec programs, zero trust architectures -this is the kind of organization you’ve been building toward." Now About The Role: "About The Role As Director of Information Security, drive the strategy, execution, and maturity Application Security, and Security Architecture and our India Security Team. This is an M5 leadership role that reports directly to the VP, Information Security , and carries significant accountability for the security posture, talent, and engineering culture of a large, multi-function organization. We are looking for a builder, someone who has led application security organizations inside high-growth technology companies where engineering velocity is a first-class value. You have a background that started in software engineering or security engineering, and you’ve never fully left it behind. You are the leader who can earn trust with a senior engineers and peers, recruit principal-level security engineers, and then go present business risk. You will manage a team of managers and senior individual contributors across your four domains, partnering deeply with Platform Engineering, Product, Legal, Privacy, and Compliance. You will set multi-year technical roadmaps, own the operational budget and tooling strategy for your org, and serve as a key voice in defining the company’s overall security risk posture and investment priorities." Now Responsibilities as extracted. Now "Who you are" qualifications: "Who you are 12+ years of progressive security experience, with at least 5 years in leadership roles managing managers and multi-functional security teams; prior experience in a high-growth consumer technology or fintech company is strongly preferred. Roots in security engineering, software development, or platform engineering—you have built things, not just governed them, and your technical instincts remain sharp enough to engage credibly with principal engineers and architects. Demonstrated experience owning multiple security domains simultaneously (e.g., SOC/detection, AppSec, architecture) with the organizational maturity to drive excellence across each without personally bottlenecking any of them. Proven track record in Application Security leadership at scale—specifically, building AppSec programs that integrate natively into SDLC, CI/CD, and developer workflows inside technology-forward organizations. Deep expertise in multi cloud security (AWS preferred), including IaC security (Terraform/CloudFormation), Kubernetes/container security, and Zero Trust architecture patterns. Strong detection engineering mindset: experience moving a SOC from alert triage to custom detection pipelines, SOAR automation, and threat-model-driven coverage. Ability to quantify and communicate security risk in business and financial terms; experience presenting to executive leadership and, ideally, board-level audiences. Talent magnet: a reputation for hiring and developing elite security engineers, with the technical credibility to attract senior ICs who could work anywhere. Familiarity with the modern security tooling ecosystem: SIEM, SOAR, DLP,EDR, EPM, CSPM/CWPP ,SaST /DaST. IAC, and container security - with the judgment to rationalize and consolidate rather than accumulate. Proficiency in at least one scripting or programming language (Python, Go, or similar); sufficient to review automation, detection logic, and security tooling code written by your team." Now Compensation: "This