Director, Application & AI Security
About this role
Professionals who prioritize guardrails over traditional gatekeeping and earn credibility through technical depth will find a natural home leading security at Lantern. The organization operates a specialty care platform handling protected health information at scale while rapidly adopting artificial intelligence as a top company priority. The person in this seat owns application and AI security end-to-end, making it safe for engineering teams to move quickly by establishing golden paths and secure defaults.
This role exists to scale a growing security function and set the secure-design standards that the broader engineering organization builds against. Responsibilities include building out a team from an existing senior engineer, managing application security across the development lifecycle, and securing AI and machine learning systems against prompt injection, data egress, and model risks. The ideal candidate balances a delivery-oriented mindset with rigorous risk calibration, treating security architecture as an enabler for the business rather than an operational bottleneck.
What you will do
- Own application security across the development lifecycle, covering static, dynamic, and interactive analysis, dependency security, API security, and runtime protections delivered through engineering teams.
- Own AI and ML security, including model and agent security, prompt-injection and tool-use risk, and data-egress controls for third-party model providers.
- Manage continuous AI security posture management informed by the OWASP LLM Top 10, MITRE ATLAS, and relevant AI risk-management standards.
- Own security architecture and threat modeling, including secure-by-design review and the establishment of cryptographic standards.
- Oversee DevSecOps and pipeline security with automated scanning in CI/CD and MLOps pipelines alongside software supply chain and SBOM practices.
- Manage the security-review intake process as a single front door with risk-based triage to accelerate business operations.
What you need
- A minimum of 8 years of experience in application or product security.
- A minimum of 3 years leading a team with function-level accountability.
- Demonstrated AI and ML security ownership at production scale, including model security, prompt-injection risk, and data-egress control.
- Secure SDLC leadership across SAST, DAST, SCA, IAST, and dependency risk management.
- Security architecture and threat-modeling depth with the technical standing to review designs alongside senior engineers.
- DevSecOps and pipeline security experience, including default scanning in CI/CD and release gating.
- API security experience on a platform handling regulated data.
- A track record of delivering security as paved roads and secure defaults rather than review gates.
Nice to have
- Healthcare or another regulated domain where PHI or comparable data flows through AI systems
- Experience standing up an AI golden path with automated egress controls
- Experience building a single security-review intake with risk-based triage and turnaround commitments
- Cryptographic standards ownership including customer-managed key models
- Hands-on familiarity with tools such as Snyk, GitHub Advanced Security, Wiz, Garak, PyRIT, and Promptfoo
Benefits
- Medical Insurance
- Dental Insurance
- Vision Insurance
- Short & Long Term Disability
- Life Insurance
- 401k with company match
- Flexible Time Off
- Paid Parental Leave
Skills and tech stack
Questions candidates ask
What is the remote work or office policy for this position?
This role is hybrid with at least 3 days per week required in the New York, NY offices.
What is the salary range for this role?
The base salary range is $200,000 to $275,000 annually, and the position is also eligible for an annual bonus separate from and in addition to the base salary.
What does the security team look like at the time of hire?
At hire, the team includes a senior application security engineer, with several open roles to fill across security architecture, AI/ML security, DevSecOps, and product security.
How does the security team handle reviews and intake?
You will own the security-review intake as a single front door with risk-based triage, reported against a turnaround commitment, so security accelerates the business rather than bottlenecking it.