Sr. Manager, DevSecOps and Application Security 3 Locations

Imprivata; Austin (TX); Hybrid; USD 184,000 - 228,000; Full time

Job summary

Imprivata is seeking a Sr. Manager, DevSecOps and Application Security to lead our unified security function across design through retirement. This hybrid role supports Waltham, MA; Austin, TX; or St.

Petersburg, FL offices and partners with Engineering, Product, IT, SecOps, and Architecture to embed security throughout the software lifecycle. The candidate will drive program strategy, threat modeling, secure-by-design practices, and risk-based remediation, while strengthening software

Qualifications

• Bachelor's degree in Computer Science, IT, Cybersecurity, or equivalent.
• 7+ years in DevOps, cloud engineering, software engineering, or security roles.
• 3+ years leading security engineering or AppSec teams.
• Experience embedding security into CI/CD pipelines and cloud platforms.
• Experience with SAST/DAST/SCA, secrets detection, container security, and IaC security.
• Strong scripting or programming skills and knowledge of IAM, encryption, and secure design.

Responsibilities

• Lead and develop the DevSecOps and Application Security team.
• Transition DevSecOps into Security org, define operating model and governance.
• Own program strategy, roadmap, budget, tools, and escalation paths.
• Establish security-by-design practices and threat modeling across SDLC.
• Mature application security: reviews, testing, vulnerability management.
• Strengthen software supply-chain, protect repos, build systems, credentials.

Skills

Leadership

DevSecOps

AppSec

CI/CD integration

Threat modeling

SAST/DAST/SCA

IAM & encryption

Recruitment & mentoring

Education

Bachelor's degree in CS/IT/Cybersecurity

Tools

GitHub Actions

GitLab

Jenkins

Kubernetes

Job description

Ready to join a team that's all in? At Imprivata, we deliver unified access and security management programs that eliminate friction, empowering healthcare and mission-critical organizations to work smarter, faster, and more securely.

We believe work can be more than a job or task-it's a collective spirit; the type that emboldens creativity, embraces challenge, and fosters excitement. We are constantly raising the bar on what's possible, owning the outcome of our triumphs and trials, staying nimble amidst change, and cultivating an environment where we win together. Here, your ideas matter, your differences are celebrated, and your work drives real results for your career, your teammates, and our customers.

When you join Imprivata, you embark on a shared journey of ambition and growth. We're committed to building an inclusive workplace where everyone feels valued and supported. If you're looking for a place to match your passion with purpose and where every day you can make an impact, you'll find it here.

We are seeking a Sr. Manager, DevSecOps and Application Security to join our team. This is a hybrid opportunity based out of our Waltham, MA; Austin, TX; or St. Petersburg, FL office.

Job Summary

The Sr. Manager of DevSecOps and Application Security leads Imprivata’s unified DevSecOps and application security function. This role embeds security throughout the software and infrastructure lifecycle, from design through retirement. The manager leads the team and partners with Engineering, Product, IT, Cloud and Infrastructure, Quality, SecOps, GRC, and Architecture. The role supports cloud, on-premises, hybrid, API, traditional software, and agentic AI environments.

Duties and Responsibilities

• Lead, coach, and develop the DevSecOps and Application Security team while establishing clear goals, performance expectations, and development opportunities.
• Lead the transition of DevSecOps and Application Security into the Security organization, including the operating model, staffing, governance, processes, tools, and stakeholder communications.
• Own the program strategy, roadmap, staffing plan, vendor relationships, tooling decisions, budget recommendations, intake processes, service expectations, and escalation paths.
• Establish security-by-design practices, threat modeling, architecture reviews, policy-as-code, reusable engineering patterns, developer guidance, and security training across the software development lifecycle.
• Mature application security practices, including secure design and code reviews, security testing, penetration testing, bug bounty intake, vulnerability management, and risk-based remediation.
• Implement and govern SAST, DAST, SCA, secrets detection, container and image scanning, infrastructure-as-code scanning, API testing, license analysis, and risk-based pipeline controls.
• Strengthen software supply-chain and platform security by protecting repositories, build systems, deployment identities, credentials, release artifacts, cloud services, and on-premises infrastructure.
• Address security risks involving agentic AI and Model Context Protocol servers and clients, and partner with SecOps on monitoring, incident response, tabletop exercises, and post-incident reviews.
• Establish ownership, severity criteria, remediation expectations, exception processes, executive reporting, and metrics for security findings and program performance.
• Other duties as assigned and required.

Required Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or equivalent practical experience.
• 7+ years of experience in DevOps, cloud engineering, software engineering, application security, infrastructure security, or a related discipline.
• Three or more years leading, managing, or mentoring security engineering, DevSecOps, or AppSec professionals, with experience building or maturing programs across multiple products or engineering organizations.
• Experience embedding security into CI/CD pipelines, software development workflows, cloud platforms, infrastructure as code, containers, Kubernetes, Git-based source control, and CI/CD platforms such as GitHub Actions, GitLab, or Jenkins.
• Experience with SAST, DAST, SCA, secrets detection, container security, IaC security, vulnerability management, threat modeling, and secure software supply-chain practices.
• Strong scripting or programming experience and working knowledge of IAM, least privilege, authentication, authorization, encryption, certificates, logging, and secure network design.
• Demonstrated ability to recruit, develop, motivate, and retain technical talent and translate technical risk for engineers, architects, executives, auditors, and nontechnical stakeholders.

Desired Qualifications

• Experience securing healthcare, financial services, government, or other regulated-industry products; SaaS, on-premises, hybrid, virtualized, or customer-managed deployments.
• Experience with identity security, zero trust, SBOMs, SLSA, Sigstore, artifact signing, provenance, policy-as-code, APIs, microservices, serverless, mobile, endpoint software, or agentic AI security.
• Experience integrating security tools with Jira, ServiceNow, GitHub, GitLab, SIEM, CNAPP, vulnerability management, or GRC platforms.
• Familiarity with STRIDE, PASTA, attack trees, or other threat-modeling methods; relevant certifications such as CISSP, CCSP, CSSLP, AWS Security Specialty, or equivalent.

This position offers a total compensation range of $184,000.00 to $227,700.00 (inclusive of base salary and variable compensation, such as bonuses and incentives). In addition, more information about Imprivata's benefit offerings can be found here. This range represents the high and low end of Imprivata's compensation range for this position. Actual compensation will vary and may be above or below the range based on various factors, such as a candidate's location, skills, experience, and qualifications.

At Imprivata, we have a top-notch work environment, developmental opportunities, a competitive total rewards package, and the desire to have fun. If you have the skills and qualifications as we have described above, we want to hear from you!

Imprivata provides equal employment opportunities, regardless of race, religion, age, sex, national origin, disability status, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.