AVP, Application Security

CVS Health Corporation; Rhode Island; Hybrid; USD 210,000 - 320,000; Full time

Job summary

CVS Health seeks an Associate Vice President of Application Security to define and execute the enterprise strategy for securing software across the full development lifecycle. This leader owns policies, standards, and tooling that enable CVS Health's engineering teams to build and deploy secure applications at scale.

The AVP will lead a high-performing team of security engineers, partner with Developer Experience, and advise executives on software security risk, balancing security outcomes with

Responsibilities

• Define and own the enterprise application security strategy, roadmap, and policy framework.
• Establish and enforce technical standards for secure software development.
• Serve as a trusted advisor to senior technology executives on security risks and best practices.
• Drive continuous improvement with metrics, benchmarking, and innovation.
• Lead SDLC integration of security scanning, testing, and policy enforcement into CI/CD pipelines.
• Define strategy for SAST, manage tuning to reduce false positives and ensure coverage.
• Oversee DAST programs and automate scanning schedules and triage processes.
• Own the WAF strategy, configurations, and operations aligned with zero-trust principles.
• Manage code repository scanning for secrets and misconfigurations with automated enforcement.
• Develop policies for AI-assisted code generation security and govern third-party software risk.
• Manage SCA program to identify vulnerabilities in libraries and dependencies.
• Oversee CDN security and enforce TLS standards and threat protection.
• Own the application security technology stack, vendor relationships, and roadmap.

Job description

We're building a world of health around every individual - shaping a more connected, convenient and compassionate health experience. At CVS Health®, you'll be surrounded by passionate colleagues who care deeply, innovate with purpose, hold ourselves accountable and prioritize safety and quality in everything we do. Join us and be part of something bigger - helping to simplify health care one person, one family and one community at a time.

Position Summary

CVS Health is seeking a polished and experienced security leader to serve as Associate Vice President of Application Security, responsible for defining and executing the enterprise strategy for securing software across its full development lifecycle. This role owns the policies, technical standards, and tooling that enable CVS Health's engineering teams to build and deploy secure applications at scale. The AVP will lead a high-performing team of application security engineers and architects, partner deeply with Developer Experience leadership to embed security seamlessly into agile development practices and serve as a trusted advisor to executive stakeholders on software security risk. This leader will balance targeted security outcomes with developer productivity, ensuring that security is an enabler - not a barrier - to innovation.

Key Responsibilities

Strategic Leadership

• Define and own the enterprise application security strategy, roadmap, and policy framework, aligned with CVS Health's business objectives and regulatory obligations.
• Establish and enforce technical standards for secure software development, including code scanning, code vulnerability management, and secure-by-design principles.
• Serve as a subject matter expert and trusted advisor to senior technology and business executives on emerging application security risks, attack trends, and industry best practices.
• Drive continuous improvement across the application security program through metrics, benchmarking, and innovation.

Application Security Engineering & Controls

• Secure Development Lifecycle (SDLC) Integration: Lead the integration of application security scanning, testing, and policy enforcement gates into CI/CD pipelines across the enterprise. Partner with Developer Experience leadership to ensure security tooling is frictionless, developer-friendly, and compatible with agile delivery practices.
• Static Application Security Testing (SAST): Define strategy, standards, and tooling for enterprise-wide SAST scanning. Manage tuning of rulesets to reduce false positives, drive remediation workflows, and ensure coverage across all critical code repositories.
• Dynamic Application Security Testing (DAST): Oversee DAST program covering pre-production and production environments. Establish automated scanning schedules, triage processes, and integration with enterprise vulnerability management platforms.
• Web Application Firewall (WAF) Management: Own the strategy, configuration, and operations of the enterprise WAF platform. Define and maintain rule sets, monitor for emerging threats, and ensure alignment with zero-trust and defense-in-depth principles.
• Code Repository Scanning: Implement and manage continuous scanning of source code repositories for secrets, misconfigurations, exposed credentials, and policy violations. Establish guardrails and automated enforcement to prevent insecure code from reaching production.
• AI-Assisted Code Generation Security: Develop policies and technical controls to assess and govern security risks introduced by AI-assisted code generation tools (e.g., GitHub Copilot, generative AI coding assistants). Define standards for safe use and implement scanning capabilities to detect AI-generated code vulnerabilities.
• Third-Party and Open-Source Software (SCA) Scanning: Manage the Software Composition Analysis (SCA) program to identify and remediate vulnerabilities in third-party libraries and open-source dependencies. Maintain visibility into the software supply chain and drive compliance with internal ingestion policies.
• Content Delivery Network (CDN) Security Management: Oversee security configuration and policy enforcement for content delivery network infrastructure. Ensure CDN-layer protections - including DDoS mitigation, bot management, and TLS standards - are aligned with enterprise security policy.
• Application Security Technology Stack: Own the full application security tooling portfolio. Manage vendor relationships, licensing, platform health, and roadmap alignment. Evaluate and introduce emerging technologies to improve coverage, automation, and developer experience.

Governance & Compliance

• Define and maintain application security policies, standards, and operational procedures.
• Ensure compliance with applicable regulatory frameworks and industry standards, including HIPAA, PCI-DSS, CCPA, NIST SSDF, and OWASP.
• Provide executive-level reporting and governance dashboards that communicate program health, risk posture, and remediation progress.
• Establish and main