1 day ago
Indianapolis, IN, USAStaff+
Responsibilities
- Own the AppSec program strategy, roadmap, architecture standards, risk register, exception process, and program outcomes.
- Embed with development teams during architecture and design and lead STRIDE or equivalent threat modeling for new systems and major features.
- Build and sustain a security champions program and deliver developer security training.
- Design and own the AppSec toolchain, including SAST, SCA, secrets scanning, container image scanning, and DAST, and integrate it into CI/CD pipelines.
- Own findings triage, false-positive reduction, architecture security reviews, penetration-testing coordination, and remediation tracking.
- Maintain audit-ready evidence for ISO 27001 Annex A.8 controls and support SOC 2 secure-development criteria.
- Report AppSec program health, findings, metrics, standards, and risk trade-offs to IT leadership and cross-functional stakeholders.
- Track emerging AI security trends and support safe AI adoption across the company.
Requirements
- Demonstrated experience building and operating application security programs with organization-wide impact.
- Ability to define scalable security controls and architecture standards for web and cloud-native workloads.
- Experience with threat modeling, security architecture reviews, application security tooling, vulnerability remediation, and penetration-testing coordination.
- Ability to evaluate competing tools and approaches, make defensible architecture decisions, and prioritize security debt using risk-based trade-offs.
- Strong written and verbal communication skills for working with developers, infrastructure security, IT leadership, and external vendors.
- Ability to operate autonomously, influence through technical credibility, and communicate security topics to non-technical executives.
Benefits
- Remote work arrangement, indicated by the #LI-Remote designation.
- Benefits may include health, dental, and vision coverage; HSA/FSA; matching retirement plans; paid vacation and parental leave; adoption and infertility assistance; and additional benefits.
Categories
About Trimedx
Trimedx provides clinical asset management and biomedical engineering services to hospitals and health systems, including maintenance and repair of medical and imaging equipment, lifecycle planning, and device cybersecurity. It also offers the TMX clinical asset intelligence platform to analyze device performance and guide capital decisions. Founded in 1998 and headquartered in Indianapolis, it is a privately held company serving U.S. healthcare providers.