Staff Application Security Engineer – Threat Research
CVS Health2 days ago
Base Salary
$107k - $284k/yr
Responsibilities
- Implement and support application security standards, policies, controls, and secure coding practices.
- Partner with engineering teams on secure design, development, testing, deployment, design reviews, and remediation of security findings.
- Research emerging threats, vulnerabilities, attack techniques, and security trends, and perform threat modeling and application security assessments.
- Design, configure, and support security technologies across cloud and enterprise environments, including controls for applications, APIs, and data.
- Support vulnerability management, incident investigations, operational security, root-cause analysis, and long-term remediation.
- Evaluate security tools, conduct research and proof-of-concept efforts, and improve application security processes and automation.
- Mentor engineers and application security practitioners through training, presentations, documentation, and knowledge sharing.
- Communicate security findings and recommendations to technical and non-technical stakeholders while influencing decisions across multiple teams.
Requirements
- At least 7 years of experience in application security, information security, software engineering, or related roles.
- At least 5 years of experience with programming or scripting languages including Java, Python, JavaScript, C#, C/C++, PowerShell, or Shell scripting.
- At least 3 years of experience securing public cloud environments such as AWS, Azure, or Google Cloud Platform.
- At least 3 years of experience with container technologies including Docker and Kubernetes.
- At least 3 years of experience with Infrastructure as Code or Security as Code practices.
- At least 3 years of experience performing application security assessments, vulnerability analysis, and threat modeling.
- Bachelor’s degree or equivalent combination of education and relevant work experience; a high school diploma or GED plus 4 years of related experience is also accepted.
- Preferred qualifications include data protection and compliance experience, web application and API security, cloud-native security architecture, security testing methodologies, network and cloud networking fundamentals, DevSecOps and security automation, threat intelligence, attack simulation, offensive security, and security research.
- Preferred familiarity includes HIPAA, HITRUST, PCI DSS, NIST, CSA, Snowflake, data and analytics platforms, and experience influencing technical decisions without direct authority.
Benefits
- Full-time position with medical, dental, and vision coverage, paid time off, retirement savings options, wellness programs, and additional resources based on eligibility.
- Eligible for CVS Health bonus, commission, or short-term incentive programs and an equity award program; compensation figures are captured separately.
- Application window is anticipated to close on October 27, 2026.
Tech Stack
Categories
About CVS Health
CVS Health is a U.S. health care company that operates thousands of retail pharmacies, runs the CVS Caremark pharmacy benefits manager, and owns the Aetna health insurance business. It sells prescriptions, retail health goods, and insurance plans, and provides primary and urgent care through MinuteClinic and other services for consumers, employers, and government programs. Founded in 1963 and headquartered in Woonsocket, Rhode Island, it is a public company traded on the NYSE.