Distinguished Engineer - Application Security
CVS Health29 days ago
Base Salary
$175k - $335k/yr
Responsibilities
- Define enterprise Application Security strategy, architecture, standards, roadmaps, and measurable outcomes.
- Own the technical strategy and end-to-end architecture for SAST, DAST, SCA, IAST/RASP, secrets scanning, API security, IaC and container scanning, ASPM/ASOC, and related services.
- Integrate application security controls into developer platforms, CI/CD pipelines, and secure-by-default paved paths.
- Lead tool selection, evaluation, integration planning, build-versus-buy decisions, and consolidation into an ASPM view.
- Provide architectural leadership, design reviews, reusable components, microservices, and hands-on contributions to Application Security services.
- Establish technical guardrails for AI coding assistants, agentic coding tools, AI-generated code, and AI-native application security capabilities.
- Partner with Developer Experience, Security Engineering, platform engineering, product management, and business stakeholders across organizational boundaries.
- Brief executive leadership and the board while influencing strategy, investment, and execution without direct authority.
Requirements
- 15+ years of experience in technical roles.
- 10+ years bridging deep technical work and business strategy.
- 10+ years of hands-on software engineering experience across multiple language ecosystems, including recent coding proficiency.
- 8+ years in enterprise-scale application security or product security roles, including threat modeling, secure design review, secure code review, and vulnerability triage.
- 5+ years setting multi-year technical strategy and architectural roadmaps for enterprise application security or DevSecOps programs.
- Deep experience selecting, integrating, tuning, and operating modern application security tooling at enterprise scale.
- Experience integrating security controls into Git-based workflows, CI/CD pipelines, developer platforms, container registries, artifact repositories, and service catalogs.
- Strong knowledge of software supply-chain security, SBOMs, SLSA, provenance, attestation, dependency and license governance, and build-system hardening.
- Deep familiarity with Kubernetes, serverless, microservices, REST, GraphQL, gRPC, and event-driven architectures.
- Demonstrated success transforming centralized application security programs into developer-native, continuous operations.
- Preferred experience with AI-assisted development tools, AI-native security tooling, OWASP AI guidance, MITRE ATLAS, NIST AI RMF, ASPM platforms, runtime application security, and healthcare-sector compliance.
- Bachelor's degree in Computer Science, Engineering, or a related field, or related experience; advanced degree and security certifications are preferred.
Benefits
- Remote work is available anywhere in the continental United States.
- Full-time position with medical, dental, and vision coverage.
- Paid time off, retirement savings options, wellness programs, and other wellbeing resources are available based on eligibility.
- Eligible for CVS Health bonus, commission, or short-term incentive programs and an equity award target.
- Anticipated application window closing date is November 30, 2026.
Tech Stack
Argo CDAssemblyC#GitGitHub ActionsGitLab CI/CDGoGraphQLgRPCJavaJavaScriptJenkinsKubernetesPythonTypeScript
Categories
About CVS Health
CVS Health is a U.S. health care company that operates thousands of retail pharmacies, runs the CVS Caremark pharmacy benefits manager, and owns the Aetna health insurance business. It sells prescriptions, retail health goods, and insurance plans, and provides primary and urgent care through MinuteClinic and other services for consumers, employers, and government programs. Founded in 1963 and headquartered in Woonsocket, Rhode Island, it is a public company traded on the NYSE.