We’re building a world of health around every individual — shaping a more connected, convenient and compassionate health experience.CVS Health is seeking a Senior Manager, Application Security Engineering to lead the strategy, execution, and continuous improvement of application security capabilities across enterprise platforms, digital products, and cloud-native environments. The Senior Manager, Application Security Engineering will be responsible for advancing secure software development practices, driving security-by-design principles, and ensuring security controls are embedded throughout the software development lifecycle.As a key security leader, the Senior Manager, Application Security Engineering will partner closely with Engineering, Product, Architecture, Infrastructure, Risk, Compliance, and Cyber Defense teams to strengthen the organization's security posture while enabling innovation and accelerating delivery. This role will oversee application security programs, vulnerability management, DevSecOps enablement, software supply cha security governance initiatives supporting CVS Health's most critical business priorities. The Senior Manager, Application Security Engineering will lead a team of security engineers responsible for securing modern cloud-native applications, APIs, containers, and enterprise platforms. This leader will establish security standards, drive automation, implement scalable security controls, and partner with development teams to identify and reduce risk across the application portfolio.PRIMARY DUTIES AND RESPONSIBILITIESLead the development, implementation, enforcement, and continuous improvement of application, engineering, and data security policies, standards, governance controls, and secure software development practices; define and maintain Health 100 security baselines, launch readiness requirements, and audit/compliance expectations while adapting controls to evolving threats and business priorities.Partner closely with Product, Engineering, Architecture, DevSecOps, Threat Modeling, GRC, and business stakeholders to embed secure engineering practices across the organization, drive onboarding to security tooling and pipelines, establish clear risk acceptance and escalation processes, and ensure alignment on security priorities, launch readiness, and governance requirements.Oversee application security engineering and testing programs across cloud, on-premises, and hybrid environments, including security architecture, SAST, SCA, secrets detection, container scanning, vulnerability analysis, pipeline integrations, scanning and gating controls, security tooling strategy, and vulnerability data quality, ownership, tagging, and reporting governance.Own end-to-end vulnerability management and operational security processes, including triage, prioritization, remediation, validation, reporting, SLA management, KPI/KRI tracking, incident response, zero-day vulnerability coordination, risk exceptions, ServiceNow workflows, ticket governance, operational excellence, and Health 100 vulnerability posture management.Build, mentor, and develop a high-performing security engineering team by establishing leadership development programs, cross-training models, operational documentation, knowledge-sharing practices, and targeted security enablement programs that strengthen secure development, remediation effectiveness, and software supply chain risk management.Drive innovation, automation, and continuous improvement through security research, evaluation of emerging technologies, workflow automation, tooling optimization, software supply chaM governance, dependency risk reduction, and scalable security operations.Own the application security strategy and roadmap, including budgeting, workforce planning, capacity management, risk management, executive reporting, KPIs/KRIs, security investments, tooling prioritization, and Health 100 security initiatives, ensuring alignment with business objectives, accelerated delivery timelines, and enterprise risk tolerance.REQUIRED QUALIFICATIONS7+ years of experience designing, implementing, and supporting enterprise security capabilities across application security, mobile application security, cloud security, vulnerability management, DevSecOps, or security engineering environments.5+ years securing cloud platforms such as AWS, Azure, and/or GCP, including network security, Infrastructure-as-Code, Security-as-Code, containers, Kubernetes, Android and iOS application security, and modern application architectures.3+ years leading enterprise security initiatives from strategy through implementation, including application security testing, mobile application security testing, MAST, vulnerability management, data protection, regulatory compliance, and secure software delivery.3+ years luding tools such as Data Theorem or similar solutions, with the ability to assess, prioritize, and drive remediation of findings across Android and iOS environments.3+ years developing and delivering security reporting and dashboards using Power BI, Grafana, or similar platforms to communicate risk, vulnerabilities, KPIs, and remediation progress to technical and leadership stakeholders.3+ years integrating security into the SDLC and CI/CD pipelines using languages such as Python, Java, JavaScript, Go, PowerShell, or similar, with a focus on automation and scalable security controls.2+ years of people leadership managing, mentoring, and developing high-performing engineering teams while driving measurable security outcomes across large-scale application portfolios, mobile and digital products, or enterprise transformation programs.PREFERRED QUALIFICATIONSStrong technical expertise in designing and securing public cloud environments (AWS, Azure, and/or GCP), including distributed, resilient, and cloud-native architectures.Experience with network security, software-defined networking (SDN), threat modeling, and development of architectural artifacts such as network, sequence, and data flow diagrams.Understanding healthcare and industry compliance frameworks, including HIPAA, HITRUST, PCI-DSS, NIST, and CSA, as well as data platform security solutions such as Snowflake.Experience implementing or managing application security platforms (e.g., Snyk, Veracode, Checkmarx, or similar), software supply chaM programs, dependency risk management, and cyber resilience initiatives.Proven ability to influence cross-functional stakeholders, collaborate effectively withport enterprise transformation programs and strategic portfolios, and contribute to the advancement of security engineering practices and standards.EDUCATIONBachelor’s degree from an accredited college or university, or equivalent combination of education and relevant work experience (High School Diploma/GED plus 4 years of related experience).BUSINESS OVERVIEWBring your heart to CVS Health. Every one of us at CVS Health shares a single, clear purpose: Bringing our heart to every moment of your health.Pay RangeThe typical pay range for this role is:$142,140.00 - $284,280.00This pay range represents the base hourly rate or base annual full-time salary for all positions in the job grade within which this position falls.This position is eligible for a CVS Health bonus, commission or short-term incentive program in addition to the base pay range listed above. This position also includes an award target in the company’s equity award program.Great benefits for great peopleThis full‑time position is eligible for a comprehensive benefits package designed to support the physical, emotional, and financial well‑being of colleagues and their families. The benefits for this position include medical, dental, and vision coverage, paid time off, retirement savings options, wellness programs, and other resources, based on eligibility.Additional details about available benefits are provided during the application process and on Benefits Moments.We anticipate the application window for this opening will close on: 09/30/2026
2 months ago