Senior AppSec Threat Research Engineer

CVS Health; Phoenix (AZ); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Medical, dental, vision benefits

Paid time off

Retirement savings options

Wellness programs

Equity award program

Job summary

CVS Health seeks a Staff Application Security Engineer - Threat Research to secure health tech by integrating security across the SDLC and mentoring engineers. You will research threats, assess applications, and build scalable defenses in cloud and on-prem environments.

You will collaborate with software engineers, architects, and security stakeholders to embed security early in design reviews, drive remediation, and advance threat intelligence initiatives, while contributing to a culture of

Qualifications

• 7+ years of experience in application security or related roles.
• 5+ years with Java, Python, JavaScript, C#, C/C++, PowerShell, or Shell scripting.
• 3+ years securing public cloud environments (AWS/Azure/GCP).
• 3+ years with Docker and Kubernetes.
• 3+ years IaC or Security as Code practices.
• 3+ years conducting app security assessments, threat modeling.

Responsibilities

• Implement and support application security standards and practices.
• Partner with engineering to integrate security into design, development, testing, and deployment.
• Promote secure coding and remediate findings.
• Contribute to security automation initiatives for efficiency.

Skills

7+ years in application security

5+ years with programming languages

3+ years cloud environments

3+ years Docker & Kubernetes

3+ years IaC / Security as Code

3+ years threat modeling & assessments

Education

Bachelor's degree

Tools

Docker

Kubernetes

CI/CD pipelines

Job description

CVS Health seeks a Staff Application Security Engineer - Threat Research to secure health tech by integrating security across the SDLC and mentoring engineers. You will research threats, assess applications, and build scalable defenses in cloud and on-prem environments.

You will collaborate with software engineers, architects, and security stakeholders to embed security early in design reviews, drive remediation, and advance threat intelligence initiatives, while contributing to a culture of