AVP, Application Security & Secure SDLC Leadership

CVS Health Corporation; Rhode Island; Hybrid; USD 210,000 - 320,000; Full time

Job summary

CVS Health seeks an Associate Vice President of Application Security to define and execute the enterprise strategy for securing software across the full development lifecycle. This leader owns policies, standards, and tooling that enable CVS Health's engineering teams to build and deploy secure applications at scale.

The AVP will lead a high-performing team of security engineers, partner with Developer Experience, and advise executives on software security risk, balancing security outcomes with

Responsibilities

• Define and own the enterprise application security strategy, roadmap, and policy framework.
• Establish and enforce technical standards for secure software development.
• Serve as a trusted advisor to senior technology executives on security risks and best practices.
• Drive continuous improvement with metrics, benchmarking, and innovation.
• Lead SDLC integration of security scanning, testing, and policy enforcement into CI/CD pipelines.
• Define strategy for SAST, manage tuning to reduce false positives and ensure coverage.
• Oversee DAST programs and automate scanning schedules and triage processes.
• Own the WAF strategy, configurations, and operations aligned with zero-trust principles.
• Manage code repository scanning for secrets and misconfigurations with automated enforcement.
• Develop policies for AI-assisted code generation security and govern third-party software risk.
• Manage SCA program to identify vulnerabilities in libraries and dependencies.
• Oversee CDN security and enforce TLS standards and threat protection.
• Own the application security technology stack, vendor relationships, and roadmap.

Job description

CVS Health seeks an Associate Vice President of Application Security to define and execute the enterprise strategy for securing software across the full development lifecycle. This leader owns policies, standards, and tooling that enable CVS Health's engineering teams to build and deploy secure applications at scale.

The AVP will lead a high-performing team of security engineers, partner with Developer Experience, and advise executives on software security risk, balancing security outcomes with