Staff Application Security Engineer

LE0021 Trimedx Holdings LLC; Indianapolis (IN); In loco; USD 120.000 - 190.000; Tempo pieno

Descrizione del lavoro

Trimedx seeks an AppSec leader to own the security program strategy across web and cloud-native workloads. You will embed with development teams, define architecture standards, and shape the toolchain (SAST, SCA, DAST) while aligning with ISO 27001 and SOC 2 requirements.

You will report program health to IT leadership, run threat modelling, and build a security champions network. This role offers autonomy to drive secure development practices across multiple teams and to influence the company’s

Competenze

• Requires deep expertise in application security and secure software development lifecycle.
• Experience embedding security into architecture and design phases with multiple development teams.
• Knowledge of ISO 27001 and SOC 2 controls and audit readiness.

Mansioni

• Own the AppSec program strategy and roadmap.
• Define security architecture standards for web and cloud-native workloads (~30% of time).
• Manage the exception and waiver process.
• Report program health and metrics to IT leadership quarterly.
• Embed with development teams at the architecture and design phase, not just code review.
• Run threat modelling (STRIDE or equivalent) for new systems and significant features.
• Build and sustain a security champions program.
• Deliver developer security training calibrated to skill level.
• Design and own the AppSec toolchain — SAST, SCA, secrets scanning, container image scanning, DAST.
• Integrate tools into CI/CD pipelines.
• Own findings triage and false-positive reduction (~20% of time).
• Conduct or commission architecture security reviews for new platforms and major system changes.
• Scope and coordinate external penetration testing.
• Track remediation within SLA (~15% of time).
• Maintain audit-ready evidence for ISO 27001 Annex A.8 controls.
• Support SOC 2 secure-development criteria.
• Own the AppSec risk register.
• Participate in audits as the subject matter expert (~10% of time).
• Serve as the primary interface between application teams, infrastructure security, and IT leadership on AppSec matters.
• Track emerging AI security trends and support safe AI adoption within InfoSec and across the broader company.

Conoscenze

AppSec

Security architecture

Threat modelling

CI/CD integration

Security metrics

Formazione

Bachelor's degree in Computer Science or Information Security

Strumenti

SAST

SCA

DAST

Container scanning

Descrizione del lavoro

If you are wondering what makes Trimedx different, it's that all of our associates share in a common purpose of serving clients, patients, communities, and each other with equal measures of care and performance. Everyone is focused on serving the customer and we do that by collaborating and supporting each other Associates look forward to coming to work each day Every associate matters and makes a difference It is truly a culture like no other — We hope you will join our team! Find out more about our company and culture here.

Responsibilities Accountabilities

• Own the AppSec program strategy and roadmap
• define security architecture standards for web and cloud-native workloads (~30% of time).
• Manage the exception and waiver process
• report program health and metrics to IT leadership quarterly.
• Embed with development teams at the architecture and design phase, not just code review
• run threat modelling (STRIDE or equivalent) for new systems and significant features (~25% of time).
• Build and sustain a security champions program
• deliver developer security training calibrated to skill level.
• Design and own the AppSec toolchain — SAST, SCA, secrets scanning, container image scanning, DAST
• integrate tools into CI/CD pipelines
• own findings triage and false-positive reduction (~20% of time).
• Conduct or commission architecture security reviews for new platforms and major system changes
• scope and coordinate external penetration testing
• track remediation within SLA (~15% of time).
• Maintain audit-ready evidence for ISO 27001 Annex A.8 controls
• support SOC 2 secure-development criteria
• own the AppSec risk register
• participate in audits as the subject matter expert (~10% of time).
• Serve as the primary interface between application teams, infrastructure security, and IT leadership on AppSec matters.
• Track emerging AI security trends and support safe AI adoption within InfoSec and across the broader company.

Problem Solving and Analysis

• Distinguishes between gatekeeping and enabling models; designs controls that scale across 6–10 development teams without becoming a bottleneck.
• Evaluates competing tools and approaches and produces defensible, documented architecture decisions without needing an existing playbook.
• Applies pattern recognition from prior program-build experience to problems with long-lived, organization-wide consequences.
• Prioritizes security debt against capacity constraints and recommends risk-based trade-offs.

Decision Making / Autonomy

• Operates with a high degree of autonomy: arrives with a point of view, validates it against Trimedx's context in the first 30 days, and executes with confidence.
• Makes and documents security architecture decisions that stand up to scrutiny.
• Escalates highly complex, cross-functional, or resourcing issues to IT leadership; day-to-day program decisions are made independently.
• Owns the AppSec program and its outcomes; is not primarily a reviewer of individual pull requests or a responder to individual incidents.

Undefined All other duties as assigned.

Communications & Interactions

• Reports program health, findings, and metrics to IT leadership on a recurring cadence.
• Leads threat modelling sessions and design reviews with development teams.
• Writes security standards, risk summaries, and program reports that are clear to a non-technical VP audience.
• Builds credibility and drives security outcomes through relationship and technical influence rather than authority.
• Serves as the organizational voice for secure development practices with leadership, development teams, and external pen-testing vendors.

#LI-Remote

At Trimedx, we are committed to cultivating a workplace culture where every associate feels valued, supported, and empowered to thrive. This culture reflects our belief that our people are our foundation, their well-being is essential, and shared success is built through meaningful work, recognition, and opportunities for growth. We embrace people’s differences which include age, race, color, ethnicity, gender, gender identity, sexual orientation, national origin, education, genetics, veteran status, disability, religion, beliefs, opinions and life experiences. Visit our website to view our Workplace Culture Commitment , along with our social channels to see what our team is up to: Facebook, LinkedIn, Twitter.

Trimedx is an Equal Opportunity Employer. Drug-Free Workplace. Because we are committed to providing a safe and productive work environment, Trimedx is a drug-free workplace. Accordingly, Associates are prohibited from engaging in the unlawful manufacture, sale, distribution, dispensation, possession, or use of any controlled substance or marijuana, or otherwise being under the influence thereof, on all Trimedx and Customer property or during working/on-call hours. Trimedx may also provide associates with benefits that include health/dental/vision, HSA/FSA, matching retirement plans, paid vacation and parental leave, adoption/infertility assistance, and more! Trimedx needs a variety of skill sets and experience levels to be able to deliver on our mission. That can be exciting for you, because whether you have a long resume or are just starting your career, have a bachelor’s or master’s degree or went to technical school, we have opportunities for you throughout the United States.