Application Security Program Manager

Cybersecurity Jobs; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

Knowledge Services is seeking an experienced Application Security Program Manager (contract) to help the State of Maine transition and sustain SSDLC practices remotely from the United States. You will lead cross-functional initiatives, align with GRC, architecture, and development teams, and drive adoption, risk reduction, and continuous improvement across the application security portfolio.

The role requires 8–10 years in leadership and cybersecurity program management, with strong stakeholder

Qualifications

• 8–10+ years in leadership roles and cybersecurity program management.
• Experience improving application security program maturity.
• Strong stakeholder management and organizational change leadership.
• Working knowledge of SSDLC.
• Certification in code and dependency scanning.
• Excellent facilitation and communication skills.
• Experience managing complex programs across multiple teams.

Responsibilities

• Support the Information Security Office in transitioning SSDLC to a sustained operating program.
• Coordinate people, decisions, workflows, and measures across technology teams.
• Shift from transition to adoption, performance, risk reduction, and continuous improvement.
• Lead a cross-functional program management effort across stakeholders.
• Partner with Vulnerability Management, Security Architecture, GRC, Dev, and platform teams.
• Ensure accountability and escalate decisions as needed while technical teams retain authority.
• Oversee application security efforts across multiple teams to improve security posture.
• Maintain a program roadmap with priorities, dependencies, risks, and backlog.
• Define measures with data owners and report on coverage, adoption, remediation, and control performance.

Skills

Leadership

Stakeholder management

SSDLC understanding

Risk management

Program management

Facilitation & communications

Education

Bachelor's degree in a related field

Security certification (code scanning)

Tools

GitHub Governance

GRC tooling

Job description

Knowledge Services is hiring a remote Application Security Program Manager (contract) to help the State of Maine transition and sustain application security practices within the SSDLC.

Responsibilities

• Support the Information Security Office in transitioning the State’s secure software development lifecycle (SSDLC) from near-complete modernization to a sustained operating program.
• Coordinate the people, decisions, workflows, and measures needed to make application security practices workable across State technology teams.
• Shift from transition activities to adoption, performance, risk reduction, and continuous improvement across the application security portfolio.
• Lead a cross-functional program management effort across application security stakeholders.
• Partner with Vulnerability Management, Security Architecture, Governance Risk and Compliance (GRC), Application Development, GitHub Governance, infrastructure and platform teams, agency product owners, and vendors.
• Drive follow-through, adoption, and accountability across stakeholders, escalating decisions to the appropriate owner while specialist teams retain authority for technical, product, and risk approvals.
• Oversee application security efforts across multiple teams to improve the State of Maine’s security posture.
• Coordinate handoff from project deliverables to owned processes, including named owners, documented handoffs, decision paths, service expectations, and an operating cadence.
• Maintain a program roadmap covering priorities, dependencies, risks, and an improvement backlog.
• Validate and improve the application risk profile and security workflows, including design review, scanning, finding triage, remediation, exceptions, and release workflows.
• Ensure guidance aligns with real tools, different applications, and vendor models.
• Plan rollout waves with development and platform partners; support security champions, training, office hours, and developer-facing guidance.
• Collect feedback and remove barriers that prevent teams from consistently applying the workflow.
• Help product and development teams convert findings into risk-ranked plans with owners, target dates, and closure evidence.
• Track coverage gaps, aging findings, blockers, and escalations while responsible teams remediate and verify results.
• Facilitate working groups and leadership reviews; maintain a responsibility model; route design questions through Security Architecture and policy, exception, and risk decisions through GRC and authorized Information Security Office leadership.
• Define measures with data owners and coordinate trustworthy reporting on application coverage, adoption, remediation, exceptions, and control performance; use trends and stakeholder feedback to propose changes and adjust priorities.
• Coordinate related initiatives across repository governance, security tooling, platform integration, third-party application security, and developer enablement.
• Surface capacity, funding, and service dependencies; prepare concise options and recommendations for leadership.

Requirements

• 8 to 10 years of experience in leadership roles and cybersecurity program management, including change agent work improving application security program maturity.
• Experience improving application security program maturity.
• Stakeholder Management and Organizational Change Management leadership.
• Working knowledge of Secure Software Development Lifecycle (SSDLC).
• Certification in code and dependency scanning.
• Strong facilitation, writing, and stakeholder communication skills.
• Substantial experience managing complex technology, cybersecurity, or application security programs across multiple teams, delivering through influence and shared accountability.
• Knowledge of software delivery and application security concepts, including security requirements, code and dependency scanning, vulnerability management, remediation, and risk treatment.
• Ability to translate technical and policy issues into clear actions, owners, decisions, and management reporting.
• Experience establishing repeatable processes, coordinating organizational change, using measures to improve performance, and managing competing priorities in an evolving program.
• Experience implementing, operationalizing, or governing SSDLC practices across multiple development teams.

Tech Stack

• Secure software development lifecycle (SSDLC)
• GitHub
• Governance Risk and Compliance (GRC)

Additional Details

• Location: United States (remote)
• Contract: through end of June 2027 (likely extension)
• Time zone: remote work acceptable for candidates residing in EST or CST time zones
• Work eligibility: cannot accept candidates requiring C2C or requiring sponsorship for a work visa

Why This Role

• Impact the trajectory of application security in the State of Maine by supporting integrity and confidentiality of critical systems.
• Work within a large IT enterprise supporting critical State applications.
• Contribute to protecting citizens’ data and enabling secure operation of essential government services.

Why Candidates May Like It

• Immersion in rapidly evolving state government issues with a fast-moving organization.
• Collaboration with peers and exposure to creative problem-solving approaches.
• Opportunities to tackle unique and complex projects in application security.