Senior AppSec Engineer - Threat Research

Partners in Digital Health; Des Moines (IA); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Medical, dental, vision

Paid time off

Retirement savings options

Job summary

CVS Health is seeking a Staff Application Security Engineer - Threat Research to secure healthcare technology across cloud and enterprise environments. You will embed security in the software lifecycle, conduct assessments, research threats, and build scalable security solutions while mentoring teams.

You will collaborate with engineers, architects, and security stakeholders to improve detection capabilities and resilience, ensuring data protection and secure design across platforms.

Qualifications

• 7+ years in application security or related roles.
• 5+ years with one or more programming languages (Java, Python, JavaScript, C#, C/C++, PowerShell, or Shell).
• 3+ years securing public cloud environments (AWS, Azure, GCP).
• 3+ years with containers (Docker, Kubernetes).
• 3+ years with IaC or Security as Code practices.
• 3+ years with application security assessments, vulnerability analysis, and threat modeling.

Responsibilities

• Implement and support application security standards and best practices.
• Partner with engineering to integrate security into design, development, testing, and deployment.

Skills

Application security

Threat research

Secure SDLC

Cloud security

Security automation

Incident response

Education

Bachelor's degree

Tools

Docker

Kubernetes

IaC / Security as Code

Job description

CVS Health is seeking a Staff Application Security Engineer - Threat Research to secure healthcare technology across cloud and enterprise environments. You will embed security in the software lifecycle, conduct assessments, research threats, and build scalable security solutions while mentoring teams.

You will collaborate with engineers, architects, and security stakeholders to improve detection capabilities and resilience, ensuring data protection and secure design across platforms.