Executive AVP, Application Security & DevSecOps

CVS Health Corporation; Northern (KY); Hybrid; USD 185,000 - 376,000; Full time

Benefits offered by this job

Medical, dental, and vision coverage

Paid time off

Retirement savings options

Wellness programs

Equity award program

Job summary

CVS Health is seeking an experienced Associate Vice President of Application Security to define and execute the enterprise security strategy across the software development lifecycle. You will lead a high-performing team of engineers and architects, partner with Developer Experience, and advise executives on software security risk.

You will drive policy, standardization, and tooling across SAST, DAST, SCA, and WAF, ensuring secure-by-design practices while balancing developer productivity and

Qualifications

• 12+ years of information security experience with at least 5 years in application security leadership.
• Hands-on coding experience in Java, Python, Go, or JavaScript.
• Experience with SAST, DAST, SCA, WAF, and repository scanning platforms.
• Knowledge of HIPAA, PCI-DSS, CCPA, OWASP, and NIST SSDF regulatory requirements.

Responsibilities

• Define and own the enterprise application security strategy, roadmap, and policy framework.
• Lead SDLC integration, including SAST/DAST/SCA gates in CI/CD pipelines.
• Oversee WAF strategy, rules, and defensive deployments.
• Build and coach a high-performing security engineering team and partners with DevEx.
• Provide executive-level governance dashboards on health, risk, and remediation progress.

Skills

Leadership

Application security

CI/CD pipelines

SAST

DAST

SCA

WAF

Secure SDLC

Regulatory compliance

Stakeholder management

DevSecOps

Education

Bachelor's Degree

Advanced degree (CS/InfoSec)

Security certifications (CISSP/CSSLP/CISM)

Tools

SAST tooling

DAST tooling

SCA tooling

WAF platform

CI/CD tooling

Job description

CVS Health is seeking an experienced Associate Vice President of Application Security to define and execute the enterprise security strategy across the software development lifecycle. You will lead a high-performing team of engineers and architects, partner with Developer Experience, and advise executives on software security risk.

You will drive policy, standardization, and tooling across SAST, DAST, SCA, and WAF, ensuring secure-by-design practices while balancing developer productivity and