AVP Cybersecurity

Cybersecurity Jobs; Blue Ash (OH); On-site; USD 172,000 - 258,000; Full time

Benefits offered by this job

Healthcare

Certification support

Incentive programs

Job summary

Ensemble RCM LLC is hiring an AVP, Application Security (DevSecOps) to build, run, and mature the organization’s application security program. This is a working, hands-on leadership role that combines secure SDLC strategy with vulnerability management and executive reporting.

You will lead a comprehensive AppSec and DevSecOps program, perform secure code reviews, threat modeling, and security architecture reviews while mentoring engineers and champions.

Qualifications

• 8+ years in application security or DevSecOps.
• 3+ years in a leadership or technical lead role.
• Certifications CSSLP, OSCP, GWAPT, or CISSP preferred.
• Familiarity with OWASP ASVS, OWASP Top 10, and NIST SSDF.
• Hands-on experience with SAST/DAST/SCA tools and tuning them.

Responsibilities

• Lead and mature an AppSec and DevSecOps program.
• Perform secure code reviews, threat modeling, and architecture reviews.
• Mentor application security engineers and embedded security champions.
• Design and tune the AppSec toolchain and integrate security gates into CI/CD pipelines.
• Own vulnerability management, triage, remediation SLAs, and executive reporting.
• Embed security requirements and threat modeling into product design (shift-left).
• Develop and maintain secure coding standards and DevSecOps playbooks.
• Manage third-party and open-source risk with software composition analysis.
• Report risk posture, metrics, and remediation trends to leadership.
• Participate in application-level security incident response and RCA.

Skills

Leadership

Communication

Independent work

Problem solving

Travel flexibility

Education

CSSLP

OSCP

GWAPT

CISSP

Tools

SAST

DAST

SCA

Checkmarx

Veracode

Snyk

Semgrep

Fortify

Jenkins

GitHub Actions

GitLab CI

Azure DevOps

AWS

Kubernetes

Job description

Ensemble RCM LLC is hiring an AVP, Application Security (DevSecOps) to build, run, and continually mature the organization’s application security program. This is a working, hands‑on leadership role that combines ownership of secure SDLC strategy and application‑layer vulnerability management with direct technical work, mentoring, and executive reporting of application risk posture.

What you’ll do

• Build, lead, and continuously improve a comprehensive AppSec and DevSecOps program covering secure SDLC, SAST/DAST/SCA, container and cloud‑native security, and API security.
• Remain a working, hands‑on team member by performing secure code reviews, threat modeling, security architecture reviews, and hands‑on remediation guidance alongside engineers.
• Mentor and develop application security engineers and embedded security champions through technical guidance, pairing on complex issues, and strengthening the team’s long‑term capability.
• Design, implement, and tune the AppSec toolchain (such as SAST, DAST, SCA, container scanning, and secrets detection) and integrate security gates into CI/CD pipelines in partnership with engineering teams.
• Own application vulnerability management, including triage, prioritization, remediation SLAs, escalation of critical findings, and personally leading response on high‑severity issues.
• Partner with engineering, product, and architecture teams to embed security requirements and threat modeling into the design phase of new products and features (“shift-left”).
• Develop and maintain application security policies, secure coding standards, and DevSecOps playbooks, and train engineering staff on secure development practices.
• Manage third‑party and open‑source risk through software composition analysis and remediation of vulnerable dependencies.
• Report application security risk posture, program metrics, and remediation trends to executive leadership and other stakeholders.
• Participate in application‑level security incident response, including root cause analysis and remediation planning.

What you bring

• 8+ years of experience in application security, secure software development, or DevSecOps, including hands‑on engineering or security engineering work.
• 3+ years in a leadership or technical lead capacity, with evidence of staying hands‑on while leading or mentoring a team.
• Relevant certification preferred, such as CSSLP, OSCP, GWAPT, or CISSP.
• Familiarity with frameworks including OWASP ASVS, OWASP Top 10, and NIST SSDF.
• Hands‑on experience with SAST, DAST, and SCA tools and the ability to configure, tune, and troubleshoot them directly (examples include Checkmarx, Veracode, Snyk, Semgrep, Fortify).
• Working proficiency in one or more programming languages sufficient for secure code review and automation/tooling (examples: Java, Python, JavaScript/TypeScript, Go, C#).
• Experience integrating security into CI/CD and DevOps toolchains (examples: Jenkins, GitHub Actions, GitLab CI, Azure DevOps).
• Experience with cloud security and container/orchestration security (examples: AWS, Azure, GCP; Docker, Kubernetes).
• Experience conducting threat modeling (examples: STRIDE) and security architecture reviews.
• Experience building and scaling a vulnerability management program, including remediation SLAs and executive reporting.
• Strong communication and presentation skills to translate technical risk for non‑technical stakeholders.
• Ability to work independently, lead a highly skilled AppSec team, and remain a credible technical practitioner.
• Strong analytical and critical thinking skills with the ability to prioritize under pressure and meet deadlines.
• Demonstrated inquisitiveness and openness to innovation, including AI, to improve processes and reduce friction while improving patient and client experiences.
• Remote role with willingness and ability to travel and work onsite at client, temporary, or corporate office locations as business needs require.
• Residency and authorization to work within the United States only.

Technologies you’ll work with

• SAST, DAST, SCA, container scanning, secrets detection
• CI/CD pipelines and CI/CD
• AppSec, software composition analysis
• Snyk, Semgrep, Fortify, Checkmarx, Veracode
• Java, Python, JavaScript/TypeScript, Go, C#
• Jenkins, GitHub Actions, GitLab CI, Azure DevOps
• AWS, Azure, GCP; Docker, Kubernetes
• STRIDE, OWASP ASVS, OWASP Top 10, NIST SSDF
• CSSLP, OSCP, GWAPT, CISSP

Location and compensation

• Location: Blue Ash, OH (remote)
• Salary: USD 171,750 - 257,700 per year
• Minimum experience: 3+ years

Benefits

• Associate benefits package covering physical, emotional, and financial health, including healthcare, time off, retirement, and well‑being programs.
• Professional certification support and tuition reimbursement.
• Quarterly and annual incentive programs.

Job competencies

• Valuing Differences
• Collaboration
• Accountability
• Time Management
• Developing Trust
• Takes Initiative