Business SME1 (Senior)

RICEFW Technologies Inc; Augusta (ME); Hybrid; USD 120,000 - 150,000; Full time

Job summary

RICEFW Technologies Inc is seeking an Application Security Program Manager (Business SME 1) to guide the Maine State SSDLC modernization into a sustained operating program. You will coordinate people, decisions, workflows, and measures to make security practices work across state technology teams, while shifting focus to adoption and risk reduction.

You will work with multiple teams to maintain a program roadmap, manage risks, and drive improvements in security posture.

Qualifications

• 8–10 years in leadership roles and program management in security.
• Experience improving application security program maturity.
• Stakeholder management and organizational change leadership.
• Secure Software Development Lifecycle (SSDLC) experience.

Responsibilities

• Coordinate transition from project deliverables to owned processes with named owners and documented handoffs.
• Validate and improve the application risk profile, security requirements, design review, scanning, triage, remediation and release workflows.
• Plan rollout waves with development and platform partners; support security champions, training, office hours, and developer-facing guidance.
• Turn findings into risk-ranked plans with owners, target dates, and evidence; track gaps and escalations during remediation.
• Facilitate working groups and leadership reviews; route questions through Security Architecture, policy, and risk decisions.
• Define measures with data owners; coordinate reporting on coverage, adoption, remediation, and control performance; adjust priorities.
• Coordinate related initiatives in governance, tooling, platform integration, and third-party security; surface capacity and funding needs.

Skills

Leadership experience

Cybersecurity program management

Stakeholder management

SSDLC

Job description

Work Location

Remote unless they reside in Maine. If they reside in Maine, they will need to report onsite one day bi-weekly, and travel costs to State office locations will not be reimbursed. (Will only consider candidates in the Eastern and Central time zones)

Top Skills

• 8 to 10 years of experience in leadership roles and cybersecurity program management.
• Experience improving application security program maturity.
• Stakeholder Management and Organizational Change Management Leadership.
• Secure Software Development Lifecycle (SSDLC).

Job Description

The Application Security Program Manager (Business SME 1) supports the Information Security Office in transitioning the State's secure software development lifecycle (SSDLC) from a near-complete modernization project to a sustained operating program. The position coordinates the people, decisions, workflows, and measures needed to make application security practices workable across State technology teams. As initial transition tasks are completed, the manager shifts effort to adoption, performance, risk reduction, and continuous improvement across the broader application security portfolio.

What Will You Do?

• Coordinate transition from project deliverables to owned processes, including named owners, documented handoffs, decision paths, service expectations, and a practical operating cadence. Maintain the program roadmap, priorities, dependencies, risks, and improvement backlog.
• Work with accountable teams to validate and improve the application risk profile, security requirements, design review, scanning, finding triage, remediation, exception, and release workflows. Ensure guidance reflects real tools and different applications and vendor models.
• Plan rollout waves with development and platform partners; support security champions, training, office hours, and clear developer-facing guidance. Gather feedback and remove barriers that prevent teams from applying the workflow consistently.
• Help product and development teams turn findings into risk-ranked plans with owners, target dates, and closure evidence. Track coverage gaps, aging findings, blockers, and escalations while the responsible teams perform remediation and verification.
• Facilitate working groups and leadership reviews, maintain an accurate responsibility model, and route design questions to Security Architecture and policy, exception, and risk decisions through GRC and authorized Information Security Office leadership.
• Define useful measures with data owners; coordinate trustworthy reporting on application coverage, adoption, remediation, exceptions, and control performance. Use trends and team feedback to propose changes, report progress, and adjust priorities.
• Coordinate related initiatives in repository governance, security tooling, platform integration, third-party application security, and developer enablement. Surface capacity, funding, and service dependencies; prepare concise options and recommendations for leadership.

What Makes This Job Unique?

• Make a Difference: The scope of this position impacts the trajectory of application security in the State of Maine, ensuring the integrity and confidentiality of critical systems.
• Show Your Strength: A chance to apply your expertise in application security and demonstrate your capabilities.
• Experience in State Government: Opportunity to work within a large IT enterprise supporting critical State applications.
• Selfless Service: Play a pivotal role in safeguarding the State's critical systems, contributing to the public good by protecting citizens ; data and ensuring the secure operation of essential government services.

Why Will You Love It Here?

• Immersion in rapidly evolving issues of state government and a fast-moving organization full of opportunity.
• Collaboration with talented peers and exposure to creative problem-solving approaches.
• Opportunities to tackle unique and complex projects in application security.

Minimum Qualifications

The manager in this role requires the ability to oversee application security efforts across multiple teams and drive program improvements to strengthen the State of Maine's security posture. We seek a self-motivated individual who thrives in fast-paced environments, seamlessly drives initiatives with multiple stakeholders, and has demonstrable experience in application security leadership. The candidate must have 8 to 10 years of experience in leadership roles, program management, and change agent roles, improving application security program maturity.

The selected candidate will be required to pass the required background checks as a condition of employment.

Preferred Qualifications

• Substantial experience managing complex technology, cybersecurity, or application security programs across multiple teams, with demonstrated delivery through influence and shared accountability.
• Working knowledge of software delivery and application security concepts, including security requirements, code and dependency scanning, vulnerability management, remediation, and risk treatment.
• Ability to translate technical and policy issues into clear actions, owners, decisions, and management reporting; strong facilitation, writing, and stakeholder communication skills.
• Experience establishing repeatable processes, coordinating organizational change, using measures to improve performance, and managing competing priorities in an evolving program.
• Experience implementing, operationalizing, or governing Secure Software Development Lifecycle (SSDLC) practices across multiple development teams.