Distinguished Engineer - Application Security
CVS Health1 day ago
Base Salary
$175k - $335k/yr
Responsibilities
- Set enterprise architectural direction and multi-year technical strategy for application security across web, mobile, API, microservice, and AI-native applications.
- Own the selection, integration, operation, and consolidation of application security tooling, including SAST, DAST, SCA, IAST/RASP, secrets scanning, API security, IaC and container scanning, and ASPM/ASOC.
- Design and contribute hands-on to microservices, reusable components, security standards, design reviews, and integrations with developer platforms and CI/CD pipelines.
- Partner with Developer Experience and Security Engineering teams to deliver secure-by-default developer workflows, paved paths, coding standards, and outcome-based security metrics.
- Establish technical guardrails for AI coding assistants, agentic coding tools, AI-generated code, and AI-native application security tooling.
- Lead the shift from centralized, gate-oriented AppSec workflows to continuous, developer-native, control-driven operations.
- Brief executive leadership and the board while influencing technical strategy, investment, and execution across organizational boundaries.
Requirements
- 15+ years of experience in technical roles with demonstrated influence across technical and executive audiences.
- 10+ years bridging deep technical work and business strategy.
- 10+ years of hands-on software engineering across multiple language ecosystems, with current coding proficiency.
- 8+ years in enterprise-scale application security or product security, including threat modeling, secure design review, secure code review, and vulnerability triage.
- 5+ years setting technical strategy and architectural roadmaps for enterprise-scale application security or DevSecOps programs.
- Hands-on enterprise experience selecting, integrating, tuning, and operating modern application security tools and integrating controls into CI/CD and developer platforms.
- Strong knowledge of software supply chain security, SBOMs, SLSA, provenance and attestation, dependency and license governance, and build-system hardening.
- Deep familiarity with cloud-native architectures, APIs, and the security implications of Kubernetes, serverless, and microservices.
- Preferred experience governing AI coding assistants and agentic developer tools, integrating AI-native AppSec tooling, and addressing prompt injection, false positives, and AI supply-chain risks.
- Preferred knowledge of OWASP LLM Top 10, OWASP AI Security & Privacy Guide, MITRE ATLAS, NIST AI RMF, ASPM, runtime application security, and relevant healthcare and regulatory requirements.
- Preferred certifications include CISSP, CSSLP, OSWE, OSCP, and GIAC certifications such as GWEB, GWAPT, GMOB, or GCSA.
- Bachelor’s degree in Computer Science, Engineering, or a related field; an advanced degree and open-source, publication, or community contributions are preferred.
Benefits
- Full-time benefits include medical, dental, and vision coverage, paid time off, retirement savings options, wellness programs, and other eligibility-based resources.
- Remote work is available anywhere in the continental United States.
- The application window is anticipated to close on December 31, 2026.
- The position is eligible for bonus, commission or short-term incentive programs and an equity award target; compensation figures are excluded from this benefits list.
Tech Stack
Argo CDAssemblyC#GitGitHub ActionsGitLab CI/CDGoGraphQLgRPCJavaJavaScriptJenkinsKubernetesPythonTypeScript
Categories
About CVS Health
CVS Health is the leading health solutions company, delivering care like no one else can. We reach more people and improve the health of communities across America through our local presence, digital channels and over 300,000 dedicated colleagues. Wherever and whenever people need us, we help them with their health – whether that’s managing chronic diseases, staying compliant with their medications or accessing affordable health and wellness services in the most convenient ways. We help people navigate the health care system – and their personal health care – by simplifying health care one person, one family and one community at a time. Follow @CVSHealth on social media.