Distinguished Engineer – Application Security

Job not on LinkedIn

🔥 18 hours ago

🌵 Arizona – Remote

🌵 Arizona – Remote

💵 $175.1k - $334.8k / year

⏰ Full Time

🟠 Senior

🔴 Lead

💻 Application Engineer

👻 Ghost score 0%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

CVS Health

WebsiteLinkedInAll Job Openings

10,000+ employees

Founded 1963

🏥 Healthcare

⚕️ Healthcare Insurance

🛒 Retail

Healthcare • Healthcare Insurance • Retail

CVS Health is a leading American healthcare company dedicated to improving health access and affordability. The company focuses on a comprehensive approach that includes health services, health insurance, and pharmacy benefits management. Through its subsidiaries, such as Aetna and CVS Caremark, CVS Health offers a range of services that facilitate wellness, condition management, and affordable prescription drug coverage. CVS Health operates neighborhood pharmacies, provides mail-order pharmacy services, and manages specialty medication programs, aiming to make healthcare convenient and accessible for everyone. Driven by a mission to connect people with essential care services, CVS Health is committed to fostering healthier communities and supporting the wellbeing of all individuals.

📋 Description

• Serve as senior technical leader and strategist for Application Security at CVS Health • Set architectural direction for securing enterprise web, mobile, API, microservice, and AI-native applications across cloud, on-prem, SaaS, and hybrid environments • Define and deliver an application security program that shifts responsibility left into design and development • Own the technical strategy and end-to-end architecture of the application security tooling stack • Select, evaluate, integrate, tune, and consolidate application security tools into an ASPM view • Act as responsible architect for Application Security components, tools, services, and CI/CD-integrated microservices • Set design standards, lead design reviews, and contribute hands-on to critical components • Support application teams adopting security standards and tooling • Establish strategy and guardrails for AI coding assistants, agentic coding tools, and AI-generated code • Evaluate and integrate AI-native application security tooling • Partner with Developer Experience and Security Engineering teams to deliver secure-by-default developer paths and integrate controls from development through production • Define secure coding standards mapped to OWASP ASVS and NIST SSDF • Establish outcome-based metrics translating application security posture into business risk • Influence strategy, investment, and execution across organizational boundaries

🎯 Requirements

• 15+ years of experience in technical roles • 10+ years of experience bridging deep technical work and business strategy • 10+ years of hands-on software engineering experience across multiple language ecosystems, with recent, current coding proficiency • 8+ years in enterprise-scale application security or product security roles • Hands-on experience with threat modeling, secure design review, secure code review, and vulnerability triage • 5+ years setting multi-year technical strategy and architectural roadmaps for enterprise-scale application security or DevSecOps programs • Deep working knowledge of SAST, DAST, SCA, IAST/RASP, secrets scanning, API security, container and IaC scanning, ASPM/ASOC • Experience integrating security controls into modern CI/CD pipelines and developer platforms • Strong working knowledge of SBOMs, CycloneDX, SPDX, SLSA, provenance and attestation, dependency and license governance, and build-system hardening • Deep familiarity with Kubernetes, serverless, microservices, REST, GraphQL, gRPC, and event-driven architectures • Experience transforming application security programs to developer-native, control-driven, continuous operations • Experience partnering with platform engineering or developer experience teams • Strong written and verbal communication, including briefing executive leadership and the board • Bachelor's degree in Computer Science, Engineering, or a related field

🏖️ Benefits

• CVS Health bonus, commission or short-term incentive program • Award target in the company’s equity award program • Medical coverage • Dental coverage • Vision coverage • Paid time off • Retirement savings options • Wellness programs • Other resources supporting physical, emotional, and financial well-being