Senior Application Security Engineer - Threat Research

CVS Health; Washington (District of Columbia); On-site; USD 107,000 - 284,000; Full time

Job summary

CVS Health is seeking a Staff Application Security Engineer - Threat Research to secure healthcare software across cloud and enterprise environments. You will integrate security into the SDLC, perform threat research, and mentor teams while building scalable defenses.

The role focuses on threat modeling, vulnerability analysis, and security automation to reduce risk and protect patient data. A strong background in cloud security and DevSecOps is essential.

Qualifications

• 7+ years of experience in application security or related roles.
• 5+ years in programming with Java, Python, JavaScript, C#, C/C++, PowerShell, or Shell.
• 3+ years securing cloud environments (AWS, Azure, GCP).
• 3+ years with Docker and Kubernetes.
• 3+ years with Infrastructure as Code or Security as Code.
• 3+ years performing app security assessments, vulnerability analysis, and threat modeling.

Responsibilities

• Implement and support application security standards and best practices.
• Integrate security into design, development, testing, and deployment processes.
• Promote secure coding practices and remediate findings.
• Contribute to security automation initiatives.
• Research threats, perform assessments and threat modeling.
• Design and manage security controls across cloud and enterprise environments.
• Mentor engineers and share security knowledge.
• Communicate findings to technical and non‑technical audiences.

Skills

Application security

Threat research

Cloud security

Container tech

Infrastructure as code

Security assessments

Threat modeling

Education

Bachelor's degree

Tools

Docker

Kubernetes

AWS

Azure

GCP

Job description

CVS Health is seeking a Staff Application Security Engineer - Threat Research to secure healthcare software across cloud and enterprise environments. You will integrate security into the SDLC, perform threat research, and mentor teams while building scalable defenses.

The role focuses on threat modeling, vulnerability analysis, and security automation to reduce risk and protect patient data. A strong background in cloud security and DevSecOps is essential.