Application Security Program Manager

Seneca Resources; Augusta (ME); Hybrid; USD 83,000 - 90,000; Full time

Job summary

Seneca Resources is seeking a Senior Application Security Program Manager to lead the transition and ongoing governance of a Secure Software Development Lifecycle (SSDLC) program for a government client in Maine. The role focuses on program management, organizational change, and cross-functional leadership to drive secure development practices enterprise-wide.

The position emphasizes governance, measurable outcomes, and collaboration with development, security, and compliance teams.

Qualifications

• 8–10 years of professional experience in cybersecurity leadership or related roles.
• Experience improving maturity and adoption of enterprise application security programs.
• Strong understanding of SSDLC methodologies and governance.
• Ability to coordinate across development, security, infrastructure, and compliance teams.

Responsibilities

• Lead SSDLC modernization initiatives and enterprise adoption.
• Develop program roadmaps, milestones, and continuous improvement plans.
• Drive enterprise-wide adoption of SSDLC practices across teams.
• Establish governance workflows and accountability models.
• Coordinate security initiatives including vulnerability management and secure release practices.
• Track findings, remediation progress, and executive metrics.
• Translate security requirements into actionable program plans.

Skills

Cybersecurity leadership

Program management

Application security governance

SSDLC

Stakeholder engagement

Organizational change management

Cross-functional leadership

Communication

Education

Bachelor's degree in IT/Cybersecurity/CS/business

Tools

GitHub governance

CI/CD pipelines

DevSecOps tooling

Job description

Job Title: Senior Application Security Program Manager – SSDLC, Cybersecurity Governance & Transformation

Job Location: Remote – Eastern or Central Time Zones Only (Maine residents must report onsite once every two weeks)

Contract Length: November 23, 2026 – June 30, 2027, with likely extension

Pay Range: $60–$65/hr W2, depending on experience

Experience Level: Senior Level (8–10 years)

Work Schedule: Monday–Friday, 40 hours per week, 8:00 AM–5:00 PM

Position Overview

Our government client in Maine is seeking an experienced Senior Application Security Program Manager to lead the operational transition, enterprise adoption, and continuous improvement of a Secure Software Development Lifecycle (SSDLC) program.

This senior-level position focuses on transitioning an established SSDLC modernization initiative into a sustainable, enterprise-wide application security program with clearly defined governance, operational processes, accountability, and measurable outcomes.

The ideal candidate brings a strong background in cybersecurity program management, application security governance, organizational change management, and cross-functional leadership.

This individual will coordinate application development, security architecture, vulnerability management, governance, infrastructure, and platform engineering teams to establish repeatable processes, improve security program maturity, and strengthen the adoption of secure development practices.

This is a program management and governance position rather than a hands-on application security engineering role.

Key Responsibilities

• Lead the transition of SSDLC modernization initiatives into sustainable application security operating processes and governance frameworks.
• Develop and manage program roadmaps, milestones, priorities, dependencies, risks, and continuous improvement initiatives.
• Drive enterprise-wide adoption of Secure Software Development Lifecycle (SSDLC) practices across application development teams.
• Establish program accountability, operational ownership, escalation procedures, and standardized security workflows.
• Coordinate application security initiatives involving secure coding, application risk assessments, security design reviews, vulnerability management, and secure release practices.
• Partner with development and security teams to improve SAST, DAST, SCA, dependency scanning, vulnerability triage, and remediation workflows.
• Collaborate with Application Development, Security Architecture, Vulnerability Management, GRC, GitHub Governance, infrastructure, and platform engineering teams.
• Lead cross-functional working sessions, stakeholder meetings, program reviews, and executive-level presentations.
• Develop and implement organizational change management strategies that improve adoption of security controls and development processes.
• Coordinate developer education, security champion initiatives, training, and knowledge-sharing activities.
• Establish risk-based vulnerability remediation processes, accountability models, target dates, and escalation procedures.
• Track application security findings, remediation progress, outstanding risks, and security exceptions.
• Develop program KPIs, dashboards, executive reports, and operational metrics to measure SSDLC adoption and application security effectiveness.
• Document governance procedures, operating standards, security workflows, and continuous improvement recommendations.
• Identify opportunities to improve application security tooling, repository governance, platform integrations, and enterprise security operations.
• Translate technical security requirements into actionable program plans while driving results across teams without direct reporting authority.

Required Qualifications

• 8–10 years of professional experience in cybersecurity leadership, technology program management, application security management, or related leadership roles.
• Demonstrated experience improving the maturity, effectiveness, and operational adoption of enterprise application security programs.
• Strong understanding of Secure Software Development Lifecycle (SSDLC) methodologies, secure software delivery, and application security governance.
• Proven ability to manage complex, cross-functional cybersecurity or enterprise technology initiatives.
• Strong experience with stakeholder engagement, organizational change management, and program transformation.
• Experience establishing governance frameworks, operational workflows, accountability models, and continuous improvement processes.
• Ability to coordinate initiatives across application development, cybersecurity, infrastructure, governance, and compliance teams.
• Experience translating complex technical and security requirements into structured implementation plans and operational processes.
• Strong knowledge of application security risks, vulnerability management, remediation coordination, and risk-based prioritization.
• Experience developing program roadmaps, performance metrics, executive reports, and governance documentation.
• Demonstrated ability to influence stakeholders, resolve organizational challenges, and drive accountability without direct managerial authority.
• Excellent communication, facilitation, leadership, organization, and problem-solving skills.
• Bachelor's degree in Information Technology, Cybersecurity, Computer Science, Business Administration, or a related discipline.
• Must reside in the Eastern or Central Time Zone.

Preferred Qualifications

• Experience implementing, operationalizing, or governing enterprise SSDLC programs across multiple software development teams.
• Knowledge of application security testing technologies, including SAST, DAST, SCA, and dependency scanning.
• Experience coordinating application vulnerability remediation, security exceptions, risk treatment, and compliance processes.
• Familiarity with GitHub governance, CI/CD pipelines, DevSecOps practices, and application security tooling.
• Experience collaborating with Governance, Risk and Compliance (GRC), Security Architecture, and Vulnerability Management teams.
• Background leading enterprise cybersecurity transformation, security program modernization, or organizational change initiatives.
• Experience supporting large government agencies, statewide technology programs, or complex enterprise environments.
• Experience developing application security dashboards, operational KPIs, executive presentations, and performance reporting.
• Familiarity with security champion programs, developer training, and enterprise security awareness initiatives.

Work Location & Schedule

• Remote eligibility: Candidates residing in the Eastern or Central Time Zones only.
• Maine residents: Required onsite attendance one day every two weeks.
• Travel expenses associated with required onsite attendance are not reimbursed.
• Monday–Friday, 40 hours per week, with an 8:00 AM–5:00 PM schedule.

Why This Opportunity?

• Lead a major enterprise application security modernization and SSDLC transformation initiative.
• Work with a government organization to establish sustainable cybersecurity governance and secure development practices.
• Influence security strategy, operational processes, and cross-functional technology teams.
• Help improve application security maturity, vulnerability management, and organizational adoption of security controls.
• Collaborate with experienced cybersecurity, development, architecture, and governance professionals.
• Remote work opportunity for candidates outside Maine residing in Eastern or Central Time Zones.
• Competitive compensation of $60–$65/hr W2.
• Contract opportunity with potential extension beyond June 2027.

About Seneca Resources

Seneca Resources is a client-focused provider of Information Technology consulting services and workforce solutions for government and commercial organizations across the United States.

Our success is driven by a strong corporate culture that values collaboration, professional growth, and career development. We offer engaging work, competitive compensation, ongoing training, and opportunities for advancement.

Seneca Resources is an Equal Opportunity Employer committed to fostering a diverse and inclusive workplace.