Lead AI Cybersecurity Champion

About the role

The Lead AI Application Security Champion position is responsible for partnering with development teams to identify and address security risks throughout the software development lifecycle, with an emphasis on LLM-based, internally developed, and agentic AI applications. This position facilitates threat modeling, develops security requirements, provides vulnerability prioritization and remediation guidance, and assists teams with applying application and AI security standards and best practices. The Lead AI Application Security Champion will also help develop security standards and guidance, connect teams with appropriate Cybersecurity resources, and may contribute to scripts, automation, and tools that improve application security capabilities.

Strategy & Planning

Acquire and interpret business, functional, technical, and architectural requirements to define application and AI security requirements

Facilitate threat modeling and abuse-case analysis for traditional and AI-enabled applications

Work with development teams, architects, and Cybersecurity partners to identify security risks and recommend appropriate controls

Maintain knowledge of application and AI security practices, technologies, threats, and regulatory considerations through training, research, and collaboration

Assist in developing and maintaining application and AI security standards, guidance, and reusable security patterns

Identify opportunities to improve secure development practices and application security capabilities

Acquisition & Deployment

Work with architects and developers to incorporate security requirements and practices into new and existing application functionality

Provide security guidance for LLM-based applications, internally developed AI solutions, agentic AI systems, and applications integrating third-party AI services

Assist development teams with applying application and AI security standards throughout the software development lifecycle

Provide recommendations for secure architecture, authentication, authorization, data protection, API security, and AI component integration

Assist development teams with understanding, prioritizing, and remediating application security vulnerabilities

Develop or recommend reusable guidance, patterns, reference implementations, and other resources that support secure development

Operational Management

Serve as the primary Application Security partner for an assigned portfolio of development teams and applications

Facilitate security reviews, threat modeling sessions, and other secure design activities

Evaluate application designs, data flows, trust boundaries, model interactions, agent capabilities, and external integrations for security risks

Provide risk-based guidance for prioritizing and remediating application security findings

Assist development teams with interpreting and complying with application and AI security standards

Connect development teams with appropriate Cybersecurity resources and specialized services

Assist development teams with engaging application penetration testers when security assessments are needed

Track and report activities, risks, recommendations, and progress associated with assigned teams and applications

Incidental Functions

Create and maintain application and AI security documentation, guidance, reference materials, and standard operating procedures

Develop and deliver application and AI security training or knowledge-sharing sessions

Participate in cross-training related to application penetration testing and AI security testing

Mentor developers and other team members in secure development practices

Assist with evaluating tools, technologies, frameworks, and service providers

Contribute to scripts, automation, reference implementations, and tools that improve capabilities

Participate in team planning, retrospectives, and knowledge-sharing activities

Make presentations to management, development teams, and peer groups as requested

Perform project and task tracking and reporting as necessary

This is a remote position.

This position is not eligible for sponsorship for work authorization now or in the future, including conversion to H1-B visa. Must be legally authorized to work in the country of employment without needing sponsorship for employment work visa status now or in the future.

Job duties include contact with other employees and access confidential and proprietary information and/or other items of value, and such access may be supervised or unsupervised. The Company therefore has determined that a review of criminal history is necessary to protect the business and its operations and reputation and is necessary to protect the safety of the Company’s staff, employees, and business relationships.

EDUCATION AND EXPERIENCE

Required

Bachelor’s Degree (or foreign equivalent) or in lieu of a degree, at least 12 years in experience in the field of Information Technology or Business (work experience or a combination of education and work experience in the field of Information Technology or Business)

8+ years of IT and/or cybersecurity experience

8+ years of experience in software development, application security, cybersecurity, or a related technology field

Experience working across multiple phases of the Software Development Lifecycle

Strong knowledge of:

Secure software design and development practices

Web applications, APIs, and common application security vulnerabilities

Authentication, authorization, session management, and identity security

Application architecture, data flows, integrations, and trust boundaries

Threat modeling, abuse-case analysis, and security requirements development

Vulnerability prioritization and remediation practices

Cloud-native application architectures and cloud security practices

Experience partnering with software development teams to identify and resolve application security risks

Experience facilitating technical discussions and communicating security requirements to developers, architects, product owners, and other stakeholders

Experience reviewing application designs and recommending practical security controls

Familiarity with AI-enabled application architectures and associated security risks

Demonstrated aptitude and interest in LLM, machine learning, and agentic AI security

Ability to work independently and collaboratively across development, architecture, product, and Cybersecurity teams

Ability to manage security engagements across a portfolio of teams and applications

Software development experience using one or more programming or scripting languages

Experience providing secure design and remediation guidance for complex application vulnerabilities

Experience reviewing source code to identify security weaknesses or validate remediation

Experience developing scripts, automation, reusable security components, or application security tools

Must be legally authorized to work in the United States without company sponsorship

Must be at least eighteen (18) years of age

Preferred

Experience performing security testing of AI-enabled applications, LLMa, or related technologies

Experience designing, developing, or supporting LLM-based applications, machine learning solutions, or agentic AI systems

Experience performing threat modeling for AI-enabled applications

Familiarity with security risks involving prompts, models, training or retrieval data, agents, tools, plugins, APIs, and third-party AI services

Experience evaluating authorization boundaries and tool permissions within agentic AI applications

Familiarity with application penetration-testing methodologies and techniques

Experience developing security standards, technical guidance, or reusable secure development patterns

Posting text as published by Sherwin-Williams.

The evidence behind this listing

Workplace

Remote Matched in posting text

Seniority

senior From the job title

Employment type

Not established

Location as listed

Cleveland, OH, United States

Pay and work authorization

Stated pay

Not stated

Visa sponsorship

Not stated

Security clearance

Not established

Citizenship

Not established