Staff App Security Engineer: Threat Research

CVS Health; Des Moines (IA); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Medical coverage

Dental coverage

Vision coverage

Paid time off

Retirement options

Wellness programs

Job summary

CVS Health is seeking a Staff Application Security Engineer - Threat Research to secure healthcare technology by combining application security engineering, threat research, and secure development practices. You will partner with engineering teams to identify risks, implement controls, and strengthen defenses across cloud and enterprise environments.

The role emphasizes embedding security throughout the SDLC, conducting security assessments, researching threats, and building scalable security

Qualifications

• 7+ years of experience in application security or related fields.
• 5+ years of experience with Java, Python, JavaScript, C#, C/C++, PowerShell or Shell scripting.

Responsibilities

• Implement and support application security standards and best practices.
• Partner with engineering to integrate security into design, development, testing, and deployment.
• Conduct threat modeling and vulnerability analysis; provide actionable risk recommendations.
• Design, configure, and manage security controls across cloud and enterprise environments.
• Mentor engineers and practitioners; share knowledge through training and documentation.
• Evaluate emerging security tools and technologies and drive security automation initiatives.

Skills

Application security

Threat modeling

Cloud security

Container security

DevSecOps

Threat research

Security assessments

Education

Bachelor's degree

Tools

AWS

Azure

GCP

Docker

Kubernetes

IaC tools

CI/CD pipelines

Job description

CVS Health is seeking a Staff Application Security Engineer - Threat Research to secure healthcare technology by combining application security engineering, threat research, and secure development practices. You will partner with engineering teams to identify risks, implement controls, and strengthen defenses across cloud and enterprise environments.

The role emphasizes embedding security throughout the SDLC, conducting security assessments, researching threats, and building scalable security