Senior Director, Enterprise Application Security

Hispanic Alliance for Career Enhancement; Rhode Island; Hybrid; USD 185,400 - 375,950; Full time

Job summary

CVS Health is seeking a senior security leader to define and execute the enterprise application security strategy across the full software development lifecycle. The AVP will lead a team of engineers and architects, partner with Developer Experience, and advise executives on software security risk.

The role balances security outcomes with developer productivity, ensuring security enables innovation while enforcing zero-trust principles and industry standards.

Qualifications

• 12+ years of progressive experience in information security and application security leadership.
• Hands-on coding experience in one or more modern programming languages (e.g., Java, Python, Go, JavaScript).
• Hands-on experience managing enterprise application security tooling (SAST, DAST, SCA, WAF).
• Strong knowledge of regulatory requirements (HIPAA, PCI-DSS, CCPA) and secure SDLC practices.

Responsibilities

• Define and own the enterprise application security strategy, roadmap, and policy framework.
• Lead the integration of security tooling into CI/CD pipelines across the enterprise.
• Oversee SAST, DAST, SCA programs and WAF management.
• Partner with engineering and DevOps to embed security into agile development practices.
• Provide executive-level governance dashboards and risk reporting.
• Build and lead a cross-functional security team.

Skills

12+ years information security

Application security leadership

Hands-on coding (Java, Python, Go, JS)

CI/CD pipelines

SAST

DAST

SCA

Web Application Firewall (WAF)

Regulatory standards (HIPAA, PCI-DSS,

Excellent communication

Education

Bachelor's Degree

Job description

CVS Health is seeking a senior security leader to define and execute the enterprise application security strategy across the full software development lifecycle. The AVP will lead a team of engineers and architects, partner with Developer Experience, and advise executives on software security risk.

The role balances security outcomes with developer productivity, ensuring security enables innovation while enforcing zero-trust principles and industry standards.