Application Security Manager (1156775)

The Judge Group; Denver (CO); Sur place; USD 120 000 - 151 000; Plein temps

Résumé du poste

The Judge Group in Denver is seeking an Application Security Manager to lead the enterprise application security program and ensure security is integrated across the Application Lifecycle. You will collaborate with software teams, cloud, architecture, and product groups to identify and mitigate security risks while enabling secure software delivery.

The role leads a team of analysts, establishes secure development standards, oversees testing programs (SAST, DAST, SCA, IAST) and drives security

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field.
• 8–10+ years of cybersecurity experience.
• 5+ years in Application Security.
• 3+ years leading security teams.
• Experience implementing enterprise DevSecOps programs.
• Experience working with Agile and CI/CD environments.
• Experience with cloud-native application security.

Responsabilités

• Lead enterprise Application Security program across SDLC.
• Partner with software teams, cloud, architecture, infrastructure, and product teams.
• Establish secure development standards and security testing programs.
• Drive adoption of security best practices per NIST CSF 2.0, SSDF, OWASP, CIS Controls.
• Coordinate threat modeling, vulnerability management, and incident response activities.

Connaissances

Cybersecurity

Application Security

DevSecOps

CI/CD

Cloud Security

Leadership

Agile

Formation

Bachelor's degree in CS/IT

Master's degree preferred

Description du poste

Position: Application Security Manager

• Secrets Detection
• Review high-risk applications

Location: Denver, CO

Salary: $120,000.00 USD Annually - $151,000.00 USD Annually

Description

Company: Healthcare

Position: Application Security Manager

Location: Denver, CO

Direct hire/permanent position

Us Citizen, GC, TN only

No Corp to corp/H1 visa’s

Job Summary

Comprehensive benefits package, Health 401K etc

Enterprise Application Portfolio - The Application Security Manager is responsible for leading the organization's Application Security program, ensuring that security is integrated throughout the Application Cycle (SDLC). This role partners closely with the software teams, cloud, architecture, infrastructure, and potentially product teams to identify, assess, and mitigate application security risks while enabling secure software delivery.

The successful candidate will lead a team of application security analysts, establish secure development standards, oversee security testing programs, and drive adoption of security best practices aligned with industry standards such as NIST SP 800-218 (Secure Software Development Framework), NIST Cybersecurity Framework (CSF) 2.0, OWASP, and CIS Controls.

ESSENTIAL DUTIES (or Key Responsibilities)

Application Security Leadership

• Collaborate with other global and regional leaders within to develop the enterprise Application Security strategy.
• Lead, mentor, and develop Application Security Analysts.
• Define AppSec metrics, KPIs, and maturity goals in collaboration with regional and global security leaders.

Secure Software Lifecycle

• Integrate security into all phases of the enterprise application portfolio.
• Ensure security requirements are incorporated during design and architecture reviews.
• Promote security-by-design principles across application teams.

Security Testing

Manage And Oversee

• Static Application Security Testing (SAST)
• Dynamic Application Security Testing (DAST)
• Software Composition Analysis (SCA)
• Interactive Application Security Testing (IAST)
• API Security Testing
• Container Security
• Infrastructure as Code (IaC) Security
• Mobile Application Security Testing
• Secrets Detection
• Review findings, prioritize remediation, and validate fixes.
• Assist in Supply Chain Security

Threat Modeling

• Facilitate threat modeling sessions with development teams.
• Identify abuse cases and attack paths.
• Recommend architectural improvements.
• Ensure high-risk applications undergo formal security architecture reviews.

Vulnerability Management

• Establish application vulnerability management processes
• Prioritize remediation using risk-based methodologies
• Track remediation SLAs
• Report vulnerability metrics to executive leadership
• Coordinate penetration testing remediation activities
• Threat Intelligence

Cloud Application Security

Support Secure Development Within Cloud Platforms Including

• AWS
• Microsoft Azure
• Google Cloud Platform

Secure Code Reviews

• Conduct manual secure code reviews
• Review high-risk applications
• Provide secure coding guidance
• Coach development teams on remediation

API Security

• Establish and set-up safe rules
• Find weak spots through testing
• Monitor logs to spot shadow APIs and strange traffic patterns

Security Awareness

Collaboration On Training Programs Covering

• OWASP Top 10
• Secure Coding
• API Security
• Cloud Security
• Common software vulnerabilities
• Secure design principles

Application Risk Management

• Perform application security risk assessments.
• Support enterprise application risk management initiatives.

Incident Response

Support Cyber Incident Response By

• Investigating application security incidents.
• Supporting forensic analysis.
• Identifying root causes.
• Leading post-incident reviews.
• Developing preventive controls.

Compliance

Support Compliance Initiatives Including

• NIST CSF 2.0
• NIST SP 800-218 (SSDF)
• NIST SP 800-53
• OWASP ASVS
• PCI DSS
• HIPAA
• SOX
• ISO/IEC 27001
• SOC 2

Other Duties And Responsibilities

MINIMUM QUALIFICATION REQUIREMENTS

Education

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field.
• Master's degree preferred.

Experience

• 8–10+ years of cybersecurity experience.
• 5+ years in Application Security.
• 3+ years leading security teams.
• Experience implementing enterprise DevSecOps programs.
• Experience working with Agile and CI/CD environments.
• Experience with cloud-native application security.