[Hiring] Distinguished Engineer - Application Security @CVS Health

Role Description

Serves as the senior technical leader and strategist for Application Security at CVS Health, setting the architectural direction for how the enterprise secures the software that it builds and integrates across web, mobile, API, microservice, and AI-native applications spanning cloud, on-prem, SaaS and hybrid environments.

• Partners with the AVP, Application Security to define and deliver an industry-leading application security program.
• Shifts security responsibility left into design and development, enforcing it consistently through CI/CD.
• Validates security continuously in production, replacing point-in-time scan-and-triage workflows with a developer-native, control-driven, threat-informed model.
• Owns the technical strategy and end-to-end architecture of the application security tooling stack.
• Accountable for tool selection, evaluation, and integration planning across a rapidly evolving vendor landscape.
• Serves as the ultimately responsible architect for the components, tools, and services developed and operated by the Application Security team.
• Provides hands-on support to application teams adopting standards and tooling.
• Charts the enterprise course through the rapidly evolving field of AI-assisted software development.
• Partners with the Developer Experience team to design and deliver the developer-facing side of the program.
• Operates as a trusted bridge between deeply technical engineering teams and business stakeholders.

Qualifications

• 15+ years of experience in technical roles, with demonstrated ability to influence without authority across technical and executive audiences.
• 10+ years of experience acting as a bridge between deep technical work and business strategy.
• 10+ years of hands-on software engineering experience across multiple language ecosystems.
• 8+ years in application security or product security roles at enterprise scale.
• 5+ years setting multi-year technical strategy and architectural roadmaps for enterprise-scale application security or DevSecOps programs.
• Deep working knowledge of the modern application security tooling landscape.
• Demonstrated experience integrating security controls into modern CI/CD pipelines and developer platforms.
• Strong working knowledge of software supply chain security.
• Deep familiarity with cloud-native architectures and API design patterns.
• Demonstrated experience leading the transformation of an application security program.
• Strong written and verbal communication skills.

Requirements

• Practical, current experience with AI-assisted software development.
• Hands-on experience evaluating and integrating AI-native application security tooling.
• Deep working knowledge of OWASP LLM Top 10 and related frameworks.
• Experience with Application Security Posture Management (ASPM) platforms.
• Healthcare-sector application security experience.
• Experience operating application security programs against various compliance standards.
• Experience with runtime application security capabilities.
• Experience partnering with product management and engineering leadership.
• Experience influencing standards bodies or industry working groups.
• Industry certifications such as CISSP, CSSLP, OSWE, OSCP, GIAC, or equivalent.
• Advanced degree in Computer Science, Software Engineering, or related technical field.
• Open-source, publication, or community contribution in relevant fields.

Education

• Bachelor's degree in Computer Science, Engineering, or a related field.

Pay Range

The typical pay range for this role is: $175,100.00 - $334,750.00. This pay range represents the base hourly rate or base annual full-time salary for all positions in the job grade within which this position falls.

Benefits

• Comprehensive and competitive mix of pay and benefits.
• Medical, dental, and vision coverage.
• Paid time off.
• Retirement savings options.
• Wellness programs and other resources.