Director, Application & AI Security
at Lantern · 501-1000 employees
Equity · $30M · Mar 2026
- Seniority
- Director Plus
- Work model
- Hybrid
- Location
- Dallas, TX - Hybrid (3x in office/week)
- Posted
- 5d ago
llmci/cd
at Lantern · 501-1000 employees
Lantern is a healthcare company that partners with employers and health plans.
<div class="content-intro"><h3>About Lantern</h3> <p>Lantern is the specialty care platform connecting people with the best care when they need it most. By curating a Network of Excellence comprised of the nation's top specialists for surgery, cancer care, infusions and more, Lantern delivers excellent care with significant cost savings to employers and their workforces. Lantern also pairs members with a dedicated care team, including Care Advocates and nurses, for the entirety of their care journey, helping them get back to good health, back to their families and back to work. With convenient access to specialists nationwide, Lantern means quality care is within driving distance for most. Lantern is trusted by the nation's largest employers to deliver care to more than 6 million members across the country. Learn more about us at lanterncare.com. </p> <hr> <p> </p></div><p>Lantern is the specialty care platform, connecting people with high-quality, affordable specialty care close to home. We operate in a regulated healthcare environment (HIPAA, HITRUST, SOC 2), we handle protected health information at scale, and we are becoming an AI healthcare company, with AI adoption a top company priority.<br><br>The Director, Application & AI Security owns application and AI security end to end: the security of the software and the AI systems Lantern builds. It is the seat most directly tied to our AI strategy. The job is to make it safe to move fast, building the golden paths and secure defaults that let teams ship product and adopt AI without waiting in a permission queue, while keeping PHI and external-model data egress genuinely protected.<br><br>You will lead a growing function. At hire, the team includes a senior application security engineer, with several open roles to fill across security architecture, AI/ML security, DevSecOps, and product security. You will build that team and set the secure-design standards the whole engineering organization builds against.<br><br>Our security philosophy is open by default, secure by design. Security exists to help the business move fast, safely, and the default answer is “yes, safely,” because guardrails are built into the platform, pipelines, and tooling rather than enforced by someone saying no. Gates exist only where risk genuinely warrants them, and even then they are automated, fast, and transparent.<br><br><strong>Location: </strong>Hybrid - at least 3 days/wk in our Dallas, TX office</p> <p><strong>Responsibilities:</strong></p> <ul> <li>Own application security across the development lifecycle, covering static, dynamic, and interactive analysis (SAST/DAST/SCA/IAST), code and dependency security, API security, and runtime protections such as WAF and API gateways, all delivered through engineering teams rather than filed as findings.</li> <li>Own AI and ML security, including model and agent security, prompt-injection and tool-use risk, and data-egress controls for third-party model providers, plus continuous AI security posture management informed by the OWASP LLM Top 10, MITRE ATLAS, and AI risk-management standards (NIST AI RMF, ISO/IEC 42001).</li> <li>Own security architecture and threat modeling, including secure-by-design review and ownership of cryptographic standards.</li> <li>Own DevSecOps and pipeline security, with scanning as a default in CI/CD and MLOps/LLMOps pipelines, release gating calibrated to risk, and software supply chain and SBOM practice.</li> <li>Own the security-review intake as a single front door with risk-based triage, reported against a turnaround commitment, so security accelerates the business rather than bottlenecking it.</li> <li>Own the application and AI security tool stack and the secure-design standards behind it.</li> </ul> <p><strong>Key Deliverables in Your First Year:</strong></p> <ul> <li>An AI golden path: an approved-model catalog and automated data-egress controls, so teams adopt AI on a governed route instead of case-by-case approvals.</li> <li>A secure SDLC paved road, with scanning in the pipeline by default and critical findings resolved within SLA.</li> <li>A single security-review intake that delivers fast, risk-based answers on a published turnaround.</li> <li>A built-out team, with the open roles filled and performing.</li> </ul> <p><strong>How You Will Work:</strong></p> <p>Much of this scope is delivered in partnership. Engineering carries remediation on application, API, and dependency findings. Platform Engineering operates the CI/CD pipelines you secure. AI Engineering builds the model integrations you govern on the security side, while the Governance, Risk & Compliance team owns AI use governance, meaning acceptable use, model inventory, and third-party model data-egress scoping, as the companion to your security accountability. Setting and holding clear service expectations across these partners is part of the role.<br><br><strong>Requirements:</strong></p> <ul> <li>A minimum of 8 years application or product security.</li> <li>A minimum of 3 years leading a team with function-level accountability.</li> <li>Demonstrated AI and ML security ownership at production scale, including model and agent security, prompt-injection and tool-use risk, and data-egress control for third-party model providers, with working fluency in the OWASP LLM Top 10, MITRE ATLAS, and AI risk-management standards (NIST AI RMF, ISO/IEC 42001).</li> <li>Secure SDLC leadership across static, dynamic, and interactive analysis (SAST/DAST/SCA/IAST), dependency and software supply-chain risk, SBOM practice, and remediation delivered through engineering teams.</li> <li>Security architecture and threat-modeling depth, with the standing to review a design and be heard by senior engineers.</li> <li>DevSecOps and pipeline security experience, including scanning as a default in CI/CD, risk-calibrated release gating, and pipeline secret handling.</li> <li>API security experience on a platform handling reg