Remote Principal AppSec Architect with AI

CVS Health; Massachusetts; Hybrid; USD 175,000 - 335,000; Full time

Benefits offered by this job

Medical benefits

Dental benefits

Vision benefits

Retirement plan

Paid time off

Wellness program

Job summary

CVS Health seeks a senior technical leader to own the architectural direction for enterprise application security, spanning web, mobile, API, and AI-native apps. You will drive tool strategy (SAST/DAST/SCA/IAST), CI/CD integration, and secure developer experiences across cloud and on-prem environments.

You will shape multi-year security roadmaps, partner with platform and developer experience teams, and advocate secure-by-default practices as AI-enabled development expands.

Qualifications

• 15+ years in technical roles with ability to influence across technical/executive audiences
• 10+ years bridging deep technical work and business strategy
• 10+ years hands-on software engineering across Java, C#, JavaScript/TypeScript, Python, Go
• 8+ years in application security or product security at enterprise scale; hands-on with threat modeling, secure design review, secure code review, vulnerability triage
• 5+ years setting multi-year technical strategy and architectural roadmaps for large security programs
• Deep knowledge of modern application security tooling and enterprise-scale integration into CI/CD
• Experience integrating security into CI/CD pipelines and developer platforms
• Strong knowledge of SBOMs, SLSA, provenance, and license governance
• Cloud-native architectures and API design patterns with security implications
• Experience transforming security programs to developer-native, continuous operations
• Experience partnering with platform engineering to deliver security as native platform features
• Strong communication, including briefing executives and board

Responsibilities

• Define and lead the architectural direction for enterprise application security programs
• Own tooling stack (SAST/DAST/SCA/IAST, secrets, API security, IaC) and integrate with CI/CD
• Guide tool selection, evaluation, and consolidation into ASPM view
• Provide hands-on support to teams adopting standards and tooling
• Set strategy for AI-assisted software development security and guardrails
• Collaborate with Developer Experience and platform teams to embed security in developer workflows
• Bridge technical teams and business stakeholders to influence investment and execution

Skills

Technical leadership

Architectural strategy

Software engineering

Threat modeling

CI/CD

DevSecOps

Cloud-native

Kubernetes

APIs

Executive communication

Security program transformation

Education

Bachelor's degree in Computer Science or related field

Tools

SAST

DAST

SCA

IAST/RASP

Secrets scanning

API security

IaC/Container scanning

ASPM/ASOC

GitHub Actions

GitLab CI

Jenkins

Argo

Job description

CVS Health seeks a senior technical leader to own the architectural direction for enterprise application security, spanning web, mobile, API, and AI-native apps. You will drive tool strategy (SAST/DAST/SCA/IAST), CI/CD integration, and secure developer experiences across cloud and on-prem environments.

You will shape multi-year security roadmaps, partner with platform and developer experience teams, and advocate secure-by-default practices as AI-enabled development expands.