Associate Vice President - Application Security

Sagility; United States; On-site; USD 180,000 - 280,000; Full time

Job summary

Sagility seeks an AVP of Application Security to provide global leadership, strategy, and governance for application security, product security, DevSecOps and AI security across the software lifecycle. You will embed security by design and lead multi-disciplinary teams in a fast-paced environment.

Role focuses on SAST/DAST/SCA testing, threat modelling, secure CI/CD, and AI-specific security testing with cloud-native architectures and regulatory alignment.

Qualifications

• Bachelor's degree in computer science, information technology, engineering, cybersecurity or related field.
• 15–20 years of technology and cybersecurity experience, including 15+ years in Application Security, Product Security, Security Architecture or DevSecOps and senior leadership experience.

Responsibilities

• Define and execute a multi-year global strategy and roadmap for Application Security, Product Security, DevSecOps and AI Security.
• Establish Secure Software Development Lifecycle policy/standards, security architecture requirements, release gates, reference patterns and risk-based assurance tiers.
• Partner with Product, Engineering, Enterprise Architecture, Cloud, Privacy, Risk, Compliance, Legal and business teams to embed security by design.
• Establish decision rights, exception governance, measurable control outcomes and executive reporting across the application portfolio.

Skills

Security leadership

SAST/DAST/SCA

Threat modelling

Penetration testing

Secure SDLC

AI security

Scripting (Python/PowerShell/Bash/Go)

Cloud security

OWASP/SANS/NIST

Education

Bachelor's degree in CS/IT/Engineering/Cybersecurity

Tools

Burp Suite

Metasploit

Cobalt Strike

Qualys

Nessus

Checkmarx

Job description

Sagility is a tech-enabled BPM services provider, a thought partner providing a broad spectrum of transformational services, to enable our clients to provide efficient and hi-quality care across the healthcare system.

Sagility combines industry-leading technology and transformation-driven BPM services with decades of healthcare domain expertise to help clients draw closer to their members. We optimize the entire member/patient experience through service offerings for clinical, case management, member engagement, provider solutions, payment integrity, claims cost containment, and analytics.

Leading industry analyst firms have consistently cited our service excellence, breadth of offerings, and ability to execute. The most recent being recognized as a leader for Healthcare Payer Operations in 2022 as a part The Healthcare Payer Operations PEAK Matrix Assessment report by Everest Group. To learn more about our recognition please visit our AWARDS SECTION

We have 48,000+ employees in 15 cities across 5 countries – India, Philippines, USA, Jamaica, and Colombia.

The AVP – Application Security will provide global leadership, strategy, security engineering governance and operational accountability for Application Security, Product Security, DevSecOps and AI Security. The role will embed security across the software and AI lifecycle, establish enterprise testing and assurance capabilities, and enable secure delivery of web, mobile, API, cloud-native and AI-enabled solutions. The position requires deep practical leadership experience across Secure code reviews (SAST), dynamic testing (DAST) and Software Composition Analysis (SCA), together with threat modelling, penetration testing, software supply-chain security, secure CI/CD and AI-specific security testing.

Application Security

• Define and execute a multi-year global strategy and roadmap for Application Security, Product Security, DevSecOps and AI Security.
• Establish Secure Software Development Lifecycle policy/standards, security architecture requirements, release gates, reference patterns and risk-based assurance tiers.
• Partner with Product, Engineering, Enterprise Architecture, Cloud, Privacy, Risk, Compliance, Legal and business teams to embed security by design.
• Establish decision rights, exception governance, measurable control outcomes and executive reporting across the application portfolio.

Security Testing & DevSecOps

• Provide end-to-end ownership of SAST, DAST and SCA capabilities, including tool strategy, onboarding, integration, tuning, triage and governance.
• Integrate security testing, secrets scanning, API testing, container scanning and infrastructure-as-code scanning into CI/CD pipelines.
• Expert knowledge of OWASP (Web/API/Mobile Top 10), SANS Top 25, MITRE ATT&CK framework, and NIST standards.
• Define risk-based quality gates and release-blocking criteria based on exploitability, application criticality, data sensitivity and business impact.
• Improve signal quality through false-positive reduction, deduplication, runtime context, attack-path analysis and developer-focused remediation guidance.
• In depth knowledge of platforms like Burp Suite, Metasploit, Cobalt Strike, Qualys, Nessus and Checkmarx.
• Automation Scripting fluency in Python, PowerShell, Bash, or Go to customize attack payloads and automate security tests.
• Establish software bill of materials, dependency governance, open-source license review and software supply-chain assurance.
• Establish threat-modelling requirements for critical applications, APIs, cloud services and material technology changes using recognized methodologies.
• Lead security architecture reviews across web, mobile, API, microservices, containers, Kubernetes, serverless and multi-cloud environments.
• Define reusable patterns for authentication, authorization, encryption, secrets management, tenant isolation, logging, monitoring and data protection.
• Govern penetration testing, API security evaluations, business-logic testing, remediation validation and independent security sign-off.

AI Security & Responsible AI Assurance

• Define security standards and assessment methods for Generative AI, LLMs, machine-learning models, RAG solutions, AI agents and AI-enabled applications.
• Assess and mitigate prompt injection, insecure output handling, sensitive-data disclosure, data or model poisoning, model extraction, excessive agency, insecure tools/plugins and AI supply-chain risks.
• Establish AI threat modelling, adversarial testing, red teaming, guardrail validation, model/API monitoring, logging and human-oversight requirements.
• Partner with AI governance, data science, privacy and engineering teams to support secure innovation aligned with ISO 42001, NIST AI RMF and OWASP guidance.
• Establish centralized intake, normalization, prioritization, ownership and remediation governance for application and AI security findings.
• Define remediation SLAs and exception processes and drive overdue critical and high-risk vulnerabilities to closure.
• Ensure alignment with HIPAA, HITRUST, PCI DSS, SOC 1, SOC 2, ISO 27001, corporate policies and client contractual requirements.
• Maintain audit-ready evidence including threat models, architecture diagrams, test reports, control matrices, risk acceptances and remediation records.
• Define KPIs and KRIs covering security-testing coverage, vulnerability aging, mean time to remediate, release-gate adoption, recurring defects and AI assurance.
• Build and lead a high-performing global team of Application Security engineers, DevSecOps specialists, penetration testers and AI Security professionals.
• Create clear accountabilities, technical career paths, succession plans, security-champion models and developer enablement programs.
• Coordinate with IR and SOC teams during active incident response or post assessment reviews.
• Govern MSSPs, testing partners, tool vendors and specialist AI Security providers against measurable outcomes and contractual commitments.
• Own budget planning, forecasting, licensing, tool rationalization and value realization for the Application Security and AI Security portfolio.
• Communicate material risks, investment needs, security posture and business outcomes to the CISO and senior stakeholders.

SUCCESS MEASURES

• Risk-based coverage of critical and high applications through SAST, DAST and SCA.
• Security controls and quality gates embedded into critical CI/CD pipelines.
• Reduction in critical and high-risk vulnerability aging, recurrence and exception backlog.
• Improved pre-production detection, remediation ownership and developer adoption of secure engineering practices.
• Consistent threat modelling, penetration testing and security sign-off for critical applications and AI systems.
• AI applications inventoried, risk-assessed, tested and monitored before and after production deployment.
• Stronger audit readiness, traceable evidence and measurable reduction in software supply-chain and AI security risk.

REQUIRED EXPERIENCE AND QUALIFICATIONS

Education

Bachelor’s degree in computer science, Information Technology, Engineering, Cybersecurity or a related discipline. A relevant postgraduate qualification is desirable.

Experience

15–20 years of overall technology and cybersecurity experience, including 15+ years in Application Security, Product Security, Security Architecture or DevSecOps and significant senior leadership experience.

Demonstrated implementation and operational leadership across SAST, DAST, SCA and IAST, including tool selection, pipeline integration, tuning, triage, governance and remediation.

Strong experience in Secure SDLC, DevSecOps, threat modelling, penetration testing, API security, cloud-native security, secrets management and software supply-chain security.

AI Security

Practical experience securing GenAI, LLM, ML or agentic AI solutions, including AI threat modelling, prompt injection testing, adversarial testing, guardrails and monitoring.

Working expertise across Azure and AWS application architectures, containers, Kubernetes, microservices and CI/CD platforms.

Experience supporting regulated environments and frameworks such as HIPAA, HITRUST, PCI DSS, SOC 2 and ISO 27001.

Leadership

Demonstrated ability to lead global teams, influence senior engineering and business stakeholders, govern partners and translate technical risk into business decisions.

PREFERRED CERTIFICATIONS (must possess one or more recognized advanced credentials)

• OSCP, OSWE, GXPN, GWAPT or equivalent offensive/application security certification.