Staff AppSec Engineer: Secure, Scalable Cloud + Equity

Koitecc Solutions; Sacramento, Northern (CA, KY); Hybrid; USD 130,000 - 261,000; Full time

Job summary

CVS Health is seeking a Staff Application Security Engineer to lead blue team efforts across applications, cloud platforms, data security, and infrastructure. You will drive secure-by-design practices, oversee incident response, and mentor peers in secure development and automated defenses.

You will collaborate with Engineering, Infrastructure, Architecture, and Business teams to embed security into CI/CD and deployment workflows, ensuring resilience and regulatory alignment.

Qualifications

• 7+ years in security engineering or defensiv e security operations.
• 3+ years securing cloud platforms (AWS, Azure, GCP).
• 3+ years with Docker, Kubernetes, and IaC/Sec‑as‑Code.
• 3+ years in programming/scripting (Python, Java, C#, JS, Shell).
• Experience in networking, identity management, and threat mitigation.

Responsibilities

• Design, implement, and maintain defensive security controls across applications, cloud platforms, data systems, and networks.
• Embed security into SDLC, CI/CD, and deployment automation frameworks.
• Lead vulnerability assessments, risk prioritization, and remediation planning.
• Mentor engineers on secure coding and defensive operations.
• Lead security incident response activities and post‑incident reviews.

Skills

Security engineering

Cloud security

Vulnerability management

Threat modeling

Security automation

Incident response

Secure development

Education

Bachelor's degree

Tools

Docker

Kubernetes

Infrastructure‑as‑Code

Security‑as‑Code

Job description

CVS Health is seeking a Staff Application Security Engineer to lead blue team efforts across applications, cloud platforms, data security, and infrastructure. You will drive secure-by-design practices, oversee incident response, and mentor peers in secure development and automated defenses.

You will collaborate with Engineering, Infrastructure, Architecture, and Business teams to embed security into CI/CD and deployment workflows, ensuring resilience and regulatory alignment.