Senior Application Security Engineer - DevSecOps Leader

CVS Health; Oregon; Hybrid; USD 130,000 - 261,000; Full time

Job summary

CVS Health is seeking a Lead Application Security Engineer to drive security across the Health 100 portfolio. You will guide secure software delivery, automate security controls, and promote secure-by-default practices throughout the SDLC.

Collaborate with engineering, cloud, platform, and security teams to implement CSPM, vulnerability management, and risk reduction. Mentors engineers, set security standards, and influence enterprise-wide security strategy.

Qualifications

• 7+ years of experience in application security engineering or related fields.
• Deep expertise in security controls across CI/CD pipelines and modern software delivery.
• Proven success leading enterprise security implementations and migrations.
• Strong knowledge of AWS, Azure, or GCP, Kubernetes, IaC/Security-as-Code, and secure SDLC.
• Hands-on programming and scripting with vulnerability management and software supply chain security.

Responsibilities

• Lead security onboarding and secure-by-default patterns across Health 100 portfolio.
• Drive platform implementations and enterprise adoption of scalable security solutions.
• Design automated security controls and policy enforcement in delivery pipelines.
• Lead remediation across cloud, container, and mobile app security initiatives.
• Provide architecture guidance and mentor engineers, define security engineering standards.

Skills

Application security

DevSecOps

Cloud security

Kubernetes

CI/CD security

Education

Bachelor's degree

Tools

Wiz

Snyk

Checkmarx

Gitleaks

Data Theorem

MobSF

SBOM tooling

Job description

CVS Health is seeking a Lead Application Security Engineer to drive security across the Health 100 portfolio. You will guide secure software delivery, automate security controls, and promote secure-by-default practices throughout the SDLC.

Collaborate with engineering, cloud, platform, and security teams to implement CSPM, vulnerability management, and risk reduction. Mentors engineers, set security standards, and influence enterprise-wide security strategy.