Staff Application Security Engineer — Threat Research

CVS Health; Richmond (VA); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Medical, dental, vision coverage

Retirement savings options

Paid time off

Job summary

CVS Health is hiring a Staff Application Security Engineer focusing on Threat Research to strengthen application defenses across cloud and enterprise environments. You will partner with engineering teams to embed security into the SDLC, perform threat modeling, and drive scalable security solutions.

Mentorship and innovation are encouraged to improve our security posture. The role emphasizes cross‑team collaboration, security automation, and continuous improvement to protect healthcare data and

Qualifications

• 7+ years of experience in application security or related roles.
• 5+ years of programming or scripting in Java, Python, JavaScript, C#, C/C++, PowerShell, or Shell.
• 3+ years securing public cloud environments (AWS, Azure, or GCP).
• 3+ years with container technologies including Docker and Kubernetes.
• 3+ years IaC or Security as Code practices.
• 3+ years of application security assessments, vulnerability analysis, and threat modeling.

Responsibilities

• Security Engineering & Secure Development: implement security standards and partner with engineers to embed security into design, development, testing and deployment.
• Threat Research & Analysis: research threats, perform assessments, threat modeling, vulnerability analysis, provide actionable recommendations.
• Security Solutions & Architecture: design and manage security controls across cloud and on‑prem environments.
• Collaboration & Communication: work with engineers, architects, platform teams and security stakeholders.
• Incident Response & Operational Support: participate in investigations and support security operations.
• Mentorship & Knowledge Sharing: mentor engineers and share knowledge through trainings and docs.
• Innovation & Continuous Improvement: evaluate new tools and drive security automation.

Skills

Application security

Threat research

Secure SDLC

Cloud security

DevSecOps

Education

Bachelor's degree

Tools

Docker

Kubernetes

AWS

Azure

GCP

CI/CD pipelines

Job description

CVS Health is hiring a Staff Application Security Engineer focusing on Threat Research to strengthen application defenses across cloud and enterprise environments. You will partner with engineering teams to embed security into the SDLC, perform threat modeling, and drive scalable security solutions.

Mentorship and innovation are encouraged to improve our security posture. The role emphasizes cross‑team collaboration, security automation, and continuous improvement to protect healthcare data and