[Hiring] AVP Cybersecurity @Ensemble Health Partners

Role Description

The AVP, Application Security (DevSecOps) is a working, hands-on leader who builds, runs, and matures the organization's application security program while remaining an active technical contributor. This role owns secure software development lifecycle (SDLC) strategy, DevSecOps tooling and automation, and application-layer vulnerability management, while also mentoring engineers and security team members and personally performing security architecture reviews, threat modeling, and critical vulnerability triage when needed. The Director partners closely with engineering, product, and infrastructure leaders to embed security into every stage of the software development lifecycle and reports on application risk posture to executive leadership.

Qualifications

• 8+ years of experience in application security, secure software development, or DevSecOps, including hands-on engineering or security engineering work.
• 3+ years in a leadership or technical lead capacity, with a demonstrated ability to remain hands-on while managing or mentoring a team.
• Relevant certification preferred (e.g., CSSLP, OSCP, GWAPT, CISSP) and familiarity with frameworks such as OWASP ASVS, OWASP Top 10, and NIST SSDF.
• Hands-on experience with SAST, DAST, and SCA tools (e.g., Checkmarx, Veracode, Snyk, Semgrep, Fortify) and the ability to configure, tune, and troubleshoot them directly.
• Working proficiency in one or more programming languages (e.g., Java, Python, JavaScript/TypeScript, Go, C#) sufficient to review code and build automation or tooling.
• Experience integrating security into CI/CD pipelines and DevOps toolchains (e.g., Jenkins, GitHub Actions, GitLab CI, Azure DevOps).
• Experience with cloud security and container/orchestration security (e.g., AWS, Azure, or GCP; Docker, Kubernetes).
• Experience conducting threat modeling (e.g., STRIDE) and security architecture reviews.
• Experience building and scaling a vulnerability management program, including remediation SLAs and executive reporting.
• Strong communication and presentation skills, with the ability to translate technical risk for non-technical stakeholders.
• Ability to work independently, lead a highly skilled AppSec team, and remain a credible technical practitioner.
• Strong analytical and critical thinking skills, with the ability to prioritize under pressure and meet deadlines.

Requirements

• Build, lead, and continuously mature a comprehensive application security (AppSec) and DevSecOps program spanning secure SDLC, SAST/DAST/SCA, container and cloud-native security, and API security.
• Serve as a working, hands-on member of the team: perform secure code reviews, threat modeling, security architecture reviews, and hands-on remediation guidance alongside individual contributors, not just through delegation.
• Mentor and develop application security engineers and embedded security champions, providing technical guidance, pairing on complex issues, and building the team's long-term technical capability.
• Design, implement, and tune the AppSec toolchain (e.g., SAST, DAST, SCA, container scanning, secrets detection) and integrate security gates into CI/CD pipelines in partnership with engineering teams.
• Own the application vulnerability management program, including triage, prioritization, remediation SLAs, and escalation of critical findings, personally leading response on high-severity issues.
• Partner with engineering, product, and architecture teams to embed security requirements and threat modeling into the design phase of new products and features ("shift-left").
• Develop and maintain application security policies, secure coding standards, and DevSecOps playbooks, and train engineering staff on secure development practices.
• Manage third-party and open-source software risk, including software composition analysis and remediation of vulnerable dependencies.
• Report on application security risk posture, program metrics, and remediation trends to executive leadership and other stakeholders.
• Participate in application-level security incident response, including root cause analysis and remediation planning.

Benefits

• Comprehensive benefits package designed to support the physical, emotional, and financial health of you and your family, including healthcare, time off, retirement, and well-being programs.
• Investment in professional development, including earning a professional certification relevant to your field and tuition reimbursement.
• Quarterly and annual incentive programs for all employees who go beyond and keep raising the bar for themselves and the company.