Staff Application Security Engineer - Blue Team

Koitecc Solutions; Sacramento, Northern (CA, KY); Hybrid; USD 130,000 - 261,000; Full time

Job summary

CVS Health is seeking a Staff Application Security Engineer to lead blue team efforts across applications, cloud platforms, data security, and infrastructure. You will drive secure-by-design practices, oversee incident response, and mentor peers in secure development and automated defenses.

You will collaborate with Engineering, Infrastructure, Architecture, and Business teams to embed security into CI/CD and deployment workflows, ensuring resilience and regulatory alignment.

Qualifications

• 7+ years in security engineering or defensiv e security operations.
• 3+ years securing cloud platforms (AWS, Azure, GCP).
• 3+ years with Docker, Kubernetes, and IaC/Sec‑as‑Code.
• 3+ years in programming/scripting (Python, Java, C#, JS, Shell).
• Experience in networking, identity management, and threat mitigation.

Responsibilities

• Design, implement, and maintain defensive security controls across applications, cloud platforms, data systems, and networks.
• Embed security into SDLC, CI/CD, and deployment automation frameworks.
• Lead vulnerability assessments, risk prioritization, and remediation planning.
• Mentor engineers on secure coding and defensive operations.
• Lead security incident response activities and post‑incident reviews.

Skills

Security engineering

Cloud security

Vulnerability management

Threat modeling

Security automation

Incident response

Secure development

Education

Bachelor's degree

Tools

Docker

Kubernetes

Infrastructure‑as‑Code

Security‑as‑Code

Job description

Staff Application Security Engineer - Blue Team

We're building a world of health around every individual - shaping a more connected, convenient and compassionate health experience. At CVS Health®, you'll be surrounded by passionate colleagues who care deeply, innovate with purpose, hold ourselves accountable and prioritize safety and quality in everything we do. Join us and be part of something bigger - helping to simplify health care one person, one family and one community at a time.

Who Are You

• A senior defensive security practitioner with deep engineering expertise and the ability to design, develop, and influence security solutions across the enterprise.
• Highly experienced in protecting applications, cloud platforms, data assets, and infrastructure through proactive detection, prevention, response, and resilience strategies.
• Passionate about building secure and scalable systems while driving continuous security improvements through automation and innovation.
• A recognized subject matter expert in application security, cloud security, data security, and network security from a Blue Team / defensive operations perspective.
• Comfortable leading security initiatives in complex environments including cloud-native architectures, distributed systems, hybrid infrastructures, and legacy platforms.
• Able to provide technical leadership during security incidents while remaining calm and effective in high‑pressure situations.
• Skilled at influencing engineering teams, mentoring peers, and driving organization‑wide adoption of secure‑by‑design principles.

Role Responsibilities

Development & Enforcement

• Design, implement, and maintain defensive security controls across applications, cloud platforms, data systems, and network environments.
• Develop and enforce enterprise‑wide application and data security standards, policies, and best practices.
• Embed security controls into SDLC processes, CI/CD pipelines, and deployment automation frameworks.
• Lead security architecture reviews and ensure alignment with organizational security objectives.
• Establish security governance frameworks that improve confidentiality, integrity, availability, and resiliency.

Collaboration & Expertise

• Partner with Engineering, Infrastructure, Architecture, and Business teams to embed secure‑by‑design practices across products and services.
• Serve as a trusted advisor and technical leader for Application Security, Cloud Security, and Secure Development practices.
• Influence technical decision‑making and security strategy across multiple teams and business units.
• Drive organization‑wide security awareness and operational readiness initiatives.

Analysis & Configuration

• Monitor, detect, investigate, and respond to security events, vulnerabilities, threats, and incidents.
• Lead vulnerability assessments, remediation planning, risk prioritization, and validation efforts across application and data platforms.
• Design, evaluate, and optimize defensive controls across cloud‑native, hybrid, and on‑premises environments.
• Conduct security assessments, threat modeling exercises, and architecture reviews to identify and mitigate risks.
• Implement advanced security solutions across multi‑cloud, colocation, and enterprise environments.

Operational Support

• Participate in a rotational on‑call schedule, including off‑hours, nights, weekends, and holidays, supporting a 24x7 operational environment.
• Lead security incident response activities including investigation, containment, eradication, recovery, and post‑incident reviews.
• Develop, maintain, and continuously improve incident response, detection, escalation, and recovery playbooks.
• Drive operational improvements that strengthen incident readiness and cyber resilience.

Mentorship & Training

• Mentor and coach engineers on secure coding practices, security engineering principles, and defensive operations.
• Provide guidance to development and operational teams on security best practices and emerging threats.
• Support training initiatives that improve security maturity across the organization.
• Foster a culture of shared responsibility for security and operational excellence.

Innovation and Research

• Research emerging threats, vulnerabilities, attack techniques, and security technologies.
• Evaluate and recommend new security tools, platforms, and defensive capabilities.
• Automate security operations using code and Security-as-Code principles to improve efficiency and scalability.
• Improve threat detection, monitoring, alerting, and response capabilities through innovation and continuous improvement.

Strategic Planning

• Contribute to long‑term security strategy, architecture roadmaps, and technology planning initiatives.
• Define and drive enterprise security objectives and key performance indicators.
• Partner with leadership to prioritize security investments and risk reduction activities.
• Develop standards and practices that improve cyber resilience, redundancy, business continuity, and recovery capabilities.

Basic Qualifications

• 7+ years of experience in security engineering, application security, cloud security, or defensive security operations.
• 3+ years of experience securing modern cloud platforms including AWS, Azure, and GCP.
• 3+ years of experience with Docker, Kubernetes, Infrastructure‑as‑Code, and Security‑as‑Code methodologies.
• 3+ years of experience in one or more programming or scripting languages such as Python, Java, C#, JavaScript, Shell, or PowerShell.
• 3+ years of experience in networking, identity management, authentication, authorization, and threat mitigation techniques.

Preferred Qualifications

• Experience designing and operating defensive security controls within cloud‑native, containerized, and distributed application environments.
• Experience implementing data protection controls and supporting regulatory and compliance requirements including GDPR, CCPA, or similar frameworks.
• Demonstrated experience designing and implementing enterprise‑scale security controls and security automation solutions.
• Deep understanding of networking, software‑defined networking (SDN), zero‑trust architectures, and cloud security models.
• Experience performing threat modeling, security architecture reviews, and secure design assessments.
• Ability to develop and interpret network, sequence, application architecture, and data flow diagrams.
• Experience with compliance and security frameworks such as NIST, PCI DSS, HIPAA, HITRUST, ISO 27001, SOC 2, or CSA.
• Experience securing enterprise data platforms, analytics environments, and data warehouses including Snowflake and similar technologies.
• Experience defining and implementing cyber resilience, business continuity, backup, redundancy, and recovery strategies.
• Relevant industry certifications such as CISSP, CCSP, GSEC, GIAC, AWS Security Specialty, Azure Security Engineer Associate, or equivalent.

Education

• Bachelor's degree from an accredited college or university, or equivalent combination of education and relevant work experience (High School Diploma/GED plus 4 years of related experience)

Pay Range

The typical pay range for this role is:

$130,295.00 - $260,590.00

This pay range represents the base hourly rate or base annual full‑time salary for all positions in the job grade within which this position falls. The actual base salary offer will depend on a variety of factors including experience, education, geography and other relevant factors. This position is eligible for a CVS Health bonus, commission or short‑term incentive program in addition to the base pay range listed above. This position also includes an award target in the company's equity award program.

Our people fuel our future. Our teams reflect the customers, patients, members and communities we serve and we are committed to fostering a workplace where every colleague feels valued and that they belong.

Great benefits for great people

We take pride in offering a comprehensive and competitive mix of pay and benefits that reflects our commitment to our colleagues and their families.

This full‑time position is eligible for a comprehensive benefits package designed to support the physical, emotional, and financial well‑being of colleagues and their families. The benefits for this position include medical, dental, and vision coverage, paid time off, retirement savings options, wellness programs, and other resources, based on eligibility.

Additional details about available benefits are provided during the application process and on Benefits Moments.

We anticipate the application window for this opening will close on: 09/22/2026

Qualified applicants with arrest or conviction records will be considered for employment in accordance with all federal, state and local laws.