AVP, Application Security

Job not on LinkedIn

🕒 July 22

🌵 Arizona, New York, +1 more states – Remote

🌵 Arizona – Remote 🗽 New York – Remote ⚓ Rhode Island – Remote

💵 $185.4k - $375.9k / year

⏰ Full Time

🔴 Lead

👮‍♂️ Cybersecurity / Security Engineer

👻 Ghost score 54%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

CVS Health

WebsiteLinkedInAll Job Openings

10,000+ employees

Founded 1963

🏥 Healthcare

⚕️ Healthcare Insurance

🛒 Retail

Healthcare • Healthcare Insurance • Retail

CVS Health is a leading American healthcare company dedicated to improving health access and affordability. The company focuses on a comprehensive approach that includes health services, health insurance, and pharmacy benefits management. Through its subsidiaries, such as Aetna and CVS Caremark, CVS Health offers a range of services that facilitate wellness, condition management, and affordable prescription drug coverage. CVS Health operates neighborhood pharmacies, provides mail-order pharmacy services, and manages specialty medication programs, aiming to make healthcare convenient and accessible for everyone. Driven by a mission to connect people with essential care services, CVS Health is committed to fostering healthier communities and supporting the wellbeing of all individuals.

📋 Description

• Define and own the enterprise application security strategy, roadmap, and policy framework • Establish and enforce secure software development technical standards • Advise senior technology and business executives on application security risks and best practices • Drive continuous improvement through metrics, benchmarking, and innovation • Integrate application security scanning, testing, and policy enforcement into enterprise CI/CD pipelines • Define and manage SAST strategy, standards, tooling, rulesets, remediation workflows, and repository coverage • Oversee DAST scanning across pre-production and production environments • Own enterprise WAF strategy, configuration, operations, rulesets, and threat monitoring • Manage continuous source-code repository scanning for secrets, misconfigurations, exposed credentials, and policy violations • Develop security policies and controls for AI-assisted code generation tools • Manage SCA for third-party libraries and open-source dependencies • Oversee CDN security configuration, DDoS mitigation, bot management, and TLS standards • Own the application security technology portfolio, vendor relationships, licensing, platform health, and roadmap • Maintain application security policies, standards, and operational procedures • Ensure compliance with HIPAA, PCI-DSS, CCPA, NIST SSDF, and OWASP • Provide executive reporting and governance dashboards on program health, risk posture, and remediation progress • Establish a risk-based software vulnerability management process • Build, lead, and develop application security engineers, architects, and program managers • Partner with Developer Experience leadership and cross-functional security, legal, compliance, and technology teams • Collaborate with Chief Data and Technology Officers across CVS Health business units • Foster a security-minded engineering culture through education, secure coding training, security champion programs, and engineering communities of practice • Track KPIs including pipeline coverage, vulnerability remediation SLAs, secrets and policy violations, WAF effectiveness, third-party risk coverage, AI code security, developer experience satisfaction, regulatory compliance, program adoption, and roadmap delivery

🎯 Requirements

• 12+ years of progressive experience in information security, including at least 5 years in application security leadership roles • Hands-on coding experience in one or more modern programming languages, such as Java, Python, Go, or JavaScript • Developer-level fluency to evaluate code-level risks and drive secure coding practices • Expertise in application security engineering and secure software development lifecycle (SDLC) practices • First-hand experience building or shipping software • Strong understanding of software architecture patterns, CI/CD pipelines, containerization, and cloud-native development • Hands-on experience managing SAST, DAST, SCA, WAF, and repository scanning platforms • Knowledge of OWASP Top 10, NIST SSDF, HIPAA, PCI-DSS, and CCPA • Ability to influence engineering culture and drive security adoption at scale within agile development environments • Experience building and managing cross-functional technical teams and influencing senior stakeholders • Excellent communication and presentation skills • Bachelor's Degree • Preferred: advanced degree in Computer Science, Information Security, or a related field • Preferred: CISSP, CSSLP, CISM, GWEB, or equivalent certifications • Preferred: experience in healthcare or other highly regulated industries • Preferred: familiarity with AI/ML-driven security tooling and modern cloud-native application security architectures • Preferred: experience implementing security programs within large-scale DevOps or platform engineering organizations

🏖️ Benefits

• CVS Health bonus, commission or short-term incentive program • Equity award program • Medical coverage • Dental coverage • Vision coverage • Paid time off • Retirement savings options • Wellness programs • Other resources supporting physical, emotional, and financial well-being