Senior Application Security Threat Research Engineer

Hispanic Alliance for Career Enhancement; Raleigh (NC); On-site; USD 107,000 - 284,000; Full time

Job summary

CVS Health is seeking a Staff Application Security Engineer - Threat Research to advance secure development and threat research across cloud and enterprise environments. You will partner with engineers to embed security into design, code, and deployment while mentoring teams and driving scalable security solutions.

The role emphasizes security assessments, threat modeling, and incident response, with collaboration across multiple domains to strengthen the application's protection and data safety.

Qualifications

• 7+ years of experience in application security.
• 5+ years with Java, Python, JavaScript, C#, C/C++, PowerShell, or Shell scripting.
• 3+ years securing public cloud environments (AWS, Azure, or GCP).
• 3+ years with Docker and Kubernetes.
• 3+ years with Infrastructure as Code or Security as Code practices.
• 3+ years performing application security assessments, vulnerability analysis, and threat modeling.

Responsibilities

• Design and implement application security standards.
• Partner with engineering teams to integrate security into SDLC.
• Conduct threat research and vulnerability analysis.
• Support incident response and operational security.
• Mentor engineers and share security practices.
• Evaluate emerging threats and security technologies.

Skills

Application security

Threat modeling

Vulnerability analysis

Secure SDLC

DevSecOps

Cloud security

Security assessments

Education

Bachelor's degree

Tools

Docker

Kubernetes

Terraform

CloudFormation

CI/CD tooling

Job description

CVS Health is seeking a Staff Application Security Engineer - Threat Research to advance secure development and threat research across cloud and enterprise environments. You will partner with engineers to embed security into design, code, and deployment while mentoring teams and driving scalable security solutions.

The role emphasizes security assessments, threat modeling, and incident response, with collaboration across multiple domains to strengthen the application's protection and data safety.