Capital One
Senior Manager, Cyber Security Product Manager, AppSec
$209K–$286K
McLean, VA +5 · Manager · Full-time · Posted Sep 28, 2026
- Location
- McLean, VA
San Jose, CA
Richmond, VA
New York, NY
Plano, TX
Riverwoods, IL - Experience
- At least 7 years in cybersecurity or information technology; at least 6 years evaluating, contributing to, or supporting development of cybersecurity capabilities; at least 3 years in application security.
- Education
- Bachelor's Degree
- Visa sponsorship
- Capital One will not sponsor a new applicant for employment authorization or offer immigration-related support for this position.
About the job
Owns Capital One’s Application Security product strategy, roadmap, tooling, governance, and AI-application security direction.
What you'll do
- Set the multi-year AppSec roadmap and align it with enterprise risk appetite and evolving threats.
- Partner with engineering and architecture teams, and evaluate AppSec tools to enable scalable developer workflows.
- Define AI-application security strategy and vulnerability governance, and communicate risks to stakeholders.
What they ask for
- Bachelor's Degree.
- At least 7 years of experience in cybersecurity or information technology.
- At least 6 years of experience evaluating, contributing to, or supporting development of cybersecurity capabilities.
- At least 3 years of application security experience.
Nice to have
- Experience with cybersecurity metrics, dashboards, people management, risk programs, and governance processes.
- AppSec product management, AI-augmented development standards, cloud-native environments, OWASP Top 10, software supply chain security, or relevant certifications (CISSP, CISM, OSCP).
Pay
$229,900 - $262,400 USD base salary (McLean, VA); $250,800 - $286,200 USD base salary (New York, NY); $209,000 - $238,500 USD base salary (Plano, TX); $209,000 - $238,500 USD base salary (Richmond, VA); $209,000 - $238,500 USD base salary (Riverwoods, IL); $250,800 - $286,200 USD base salary (San Jose, CA)
Tools
SAST, DAST, SCA, AI agents, APIs, Web, Mobile, Containers
AI focus
Define product strategy for AI-application security, including secure integration of AI agents into the SDLC, prompt engineering guardrails, and automated remediation pipelines.
Model-written summary · the original posting is authoritative