• Lead the planning and execution of offensive security testing across web applications, APIs, infrastructure, and networks. • Conduct manual and automated penetration testing and vulnerability assessments; document findings and guide remediation. • Work with DevOps, architects, and engineering leads to embed security throughout CI/CD, infrastructure, and data workflows. • Plan and run regular security audits and threat modeling sessions; coordinate with third-party firms when needed. • Proactively identify and resolve security gaps in complex, custom systems spanning cloud and on-prem environments. • Design, implement, and maintain security controls, tooling, and detection capabilities that scale with the business. • Develop roadmaps for security certifications (e.g., HIPAA, SOC 2, ISO 27001) and lead technical implementation efforts. • Manage incident response procedures, conduct postmortems, and implement long-term prevention measures. • Create and maintain high-quality documentation for security processes, infrastructure risks, and compliance status. • Stay current on threat landscapes, tools, and best practices relevant to ecommerce, health data, and hybrid infrastructures.