Navan is looking for a visionary Director of Security Engineering to lead the charge in protecting our customer-facing products and internal tools. As we pivot toward a future defined by AI-driven natural language interfaces, you will be the primary architect of a security strategy that balances rapid innovation with world-class defense-in-depth.
Reporting directly to the CISO, you will oversee two critical pillars of our defense: Product Security (S-SDLC, Threat Modeling, Pentesting) and Security Software Engineering (Core AuthN/AuthZ, Encryption Services). Your mission is to ensure that security is not a bottleneck, but a built-in feature of everything Navan builds.
What You'll Do
Strategic Leadership: Own the overall strategy and roadmap for the Product Security and Security Engineering programs.
• Scale the Function: Develop and scale a shift left security culture by integrating automated security tooling and Security as Code solutions directly into the IDE / CI.
• Architect Core Services: Oversee the design and implementation of highly scalable security frameworks for authentication, authorization, and encryption, including cutting-edge transitions to Passkeys.
• AI & Emerging Tech: Secure the next generation of Navan products, specifically focusing on the security implications of LLM-integrated natural language interfaces and AI-driven workflows.
• Cross-Functional Partnership: Act as a key liaison between Security, Engineering, and Product teams to drive risk remediation and ensure Security by Design.
• Team Building: Recruit, mentor, and manage high-performing teams, including the development of Red Team and PSIRT functions.
• Operational Excellence: Drive visibility into application vulnerabilities and technical debt, ensuring clear prioritization and pragmatic remediation.
What We're Looking For
Experience: 12+ years in Security Engineering or Software Engineering, with at least 5 years in a senior leadership role managing technical teams.
Technical Breadth: Deep expertise across the full stack, including Java Spring Framework, Cloud Infrastructure (AWS), and containerization.
Identity & Access Specialist: In-depth knowledge of modern authentication (SAML, JWT, OIDC, Passkeys) and complex multi-tenant authorization frameworks.
Security Domain Expertise: Proven track record in threat modeling, architecture reviews, and application penetration testing in high-risk environments (e.g., Fintech or Healthcare).
Tooling Mastery: Hands-on experience with S-SDLC automation, including SAST, DAST, IAST, and SCA integration.
Regulatory Knowledge: Familiarity with global compliance standards such as PCI DSS, SOC2, HIPAA, and FedRAMP.
Communication & Influence: The ability to translate complex security risks into business impact for executive stakeholders while maintaining deep technical credibility with engineers.