Staff Application Security Engineer

TRIMEDX; United States; Remote; USD 150,000 - 190,000; Full time

Benefits offered by this job

Health/dental/vision coverage

HSA/FSA

Matching retirement plans

Paid vacation and parental leave

Job summary

Trimedx is seeking an AppSec leader to own the program strategy and roadmaps for securing web and cloud-native workloads across the enterprise. You will embed with architecture and development teams, run threat modelling, manage the toolchain, and report program health to IT leadership—driving secure development and risk reduction.

This role emphasizes collaboration, training, and governance to support ISO 27001 and SOC 2 criteria while aligning with business goals.

Qualifications

• Experience leading application security programs at scale.
• Ability to embed with development teams during architecture and design.
• Proven track record reducing security debt and risk.
• Strong communication with IT leadership and engineers.

Responsibilities

• Own the AppSec program strategy and roadmap; define security architecture standards for web and cloud-native workloads.
• Manage the exception and waiver process; report program health and metrics to IT leadership quarterly.
• Embed with development teams at the architecture and design phase; run threat modelling for new systems and features.
• Build and sustain a security champions program; deliver developer security training calibrated to skill level.
• Design and own the AppSec toolchain — SAST, SCA, secrets scanning, container image scanning, DAST; integrate tools into CI/CD pipelines.
• Conduct or commission architecture security reviews; coordinate external penetration testing; track remediation within SLA.

Skills

AppSec program management

Security architecture

Threat modelling

Security training program

Stakeholder communication

Tools

SAST/DAST

SCA

CI/CD security

Job description

If you are wondering what makes Trimedx different, it’s that all of our associates share in a common purpose of serving clients, patients, communities, and each other with equal measures of care and performance.

• Everyone is focused on serving the customer and we do that by collaborating and supporting each other
• Associates look forward to coming to work each day
• Every associate matters and makes a difference

It is truly a culture like no other - We hope you will join our team! Find out more about our company and culture here.

Responsibilities

Accountabilities

• Own the AppSec program strategy and roadmap; define security architecture standards for web and cloud-native workloads (~30% of time).
• Manage the exception and waiver process; report program health and metrics to IT leadership quarterly.
• Embed with development teams at the architecture and design phase, not just code review; run threat modelling (STRIDE or equivalent) for new systems and significant features (~25% of time).
• Build and sustain a security champions program; deliver developer security training calibrated to skill level.
• Design and own the AppSec toolchain — SAST, SCA, secrets scanning, container image scanning, DAST; integrate tools into CI/CD pipelines; own findings triage and false-positive reduction (~20% of time).
• Conduct or commission architecture security reviews for new platforms and major system changes; scope and coordinate external penetration testing; track remediation within SLA (~15% of time).
• Maintain audit-ready evidence for ISO 27001 Annex A.8 controls; support SOC 2 secure-development criteria; own the AppSec risk register; participate in audits as the subject matter expert (~10% of time).
• Serve as the primary interface between application teams, infrastructure security, and IT leadership on AppSec matters.
• Track emerging AI security trends and support safe AI adoption within InfoSec and across the broader company.

Problem Solving and Analysis

• Distinguishes between gatekeeping and enabling models; designs controls that scale across 6-10 development teams without becoming a bottleneck.
• Evaluates competing tools and approaches and produces defensible, documented architecture decisions without needing an existing playbook.
• Applies pattern recognition from prior program-build experience to problems with long-lived, organization-wide consequences.
• Prioritizes security debt against capacity constraints and recommends risk-based trade-offs.

Decision Making / Autonomy

• Operates with a high degree of autonomy: arrives with a point of view, validates it against Trimedx’s context in the first 30 days, and executes with confidence.
• Makes and documents security architecture decisions that stand up to scrutiny.
• Escalates highly complex, cross-functional, or resourcing issues to IT leadership; day-to-day program decisions are made independently.
• Owns the AppSec program and its outcomes; is not primarily a reviewer of individual pull requests or a responder to individual incidents.

Communications & Interactions

• Reports program health, findings, and metrics to IT leadership on a recurring cadence.
• Leads threat modelling sessions and design reviews with development teams.
• Writes security standards, risk summaries, and program reports that are clear to a non-technical VP audience.
• Builds credibility and drives security outcomes through relationship and technical influence rather than authority.
• Serves as the organizational voice for secure development practices with leadership, development teams, and external pen-testing vendors.
• undefined
• All other duties as assigned.

#LI-Remote

At Trimedx, we are committed to cultivating a workplace culture where every associate feels valued, supported, and empowered to thrive. This culture reflects our belief that our people are our foundation, their well-being is essential, and shared success is built through meaningful work, recognition, and opportunities for growth.

We embrace people’s differences which include age, race, color, ethnicity, gender, gender identity, sexual orientation, national origin, education, genetics, veteran status, disability, religion, beliefs, opinions and life experiences.

Visit our website to view our Workplace Culture Commitment , along with our social channels to see what our team is up to: Facebook , LinkedIn , Twitter.

Trimedx is an Equal Opportunity Employer. Drug-Free Workplace.

Because we are committed to providing a safe and productive work environment, Trimedx is a drug-free workplace. Accordingly, Associates are prohibited from engaging in the unlawful manufacture, sale, distribution, dispensation, possession, or use of any controlled substance or marijuana, or otherwise being under the influence thereof, on all Trimedx and Customer property or during working/on-call hours.

• Trimedx may also provide associates with benefits that include health/dental/vision, HSA/FSA, matching retirement plans, paid vacation and parental leave, adoption/infertility assistance, and more!