Distinguished Engineer - Application Security

We’re building a world of health around every individual — shaping a more connected, convenient and compassionate health experience. At CVS Health®, you’ll be surrounded by passionate colleagues who care deeply, innovate with purpose, hold ourselves accountable and prioritize safety and quality in everything we do. Join us and be part of something bigger – helping to simplify health care one person, one family and one community at a time.

Position Summary

Position Summary:

This is a rare opportunity to help define the future of Application Security at CVS Health. As the technical counterpart to the AVP of Application Security, you will drive enterprise AppSec strategy, secure AI adoption, and the transformation of software security at one of the largest healthcare organizations in the world.

The Distinguished Engineer - Application Security serves as the senior technical leader and strategist for Application Security at CVS Health, setting the architectural direction for how the enterprise secures the software that it builds and integrates across web, mobile, API, microservice, and AI-native applications spanning cloud, on-prem, SaaS and hybrid environments. Partners with the AVP, Application Security to define and deliver an industry-leading application security program that shifts security responsibility left into design and development, enforces it consistently through CI/CD, and validates it continuously in production, replacing point-in-time scan-and-triage workflows with a developer-native, control-driven, threat-informed model.

Working across the engineering and security organizations, this leader owns the technical strategy and end-to-end architecture of the application security tooling stack including SAST, DAST, SCA, IAST/RASP, secrets scanning, API security, IaC and container scanning, ASPM/ASOC and its integration into the Developer Experience platform and enterprise CI/CD pipelines, so that security controls are consumed as native platform capabilities by application teams rather than as separate bolt-on tools. Accountable for tool selection, evaluation, and integration planning across a rapidly evolving vendor landscape, including build-vs-buy decisions and consolidation into a coherent Application Security Posture Management (ASPM) view. Serves as the ultimately responsible architect for the components, tools, and services developed and operated by the Application Security team, including microservices that integrate AppSec tools into CI/CD, reusable components, setting design standards, leading design reviews, and contributing hands-on to critical components. Provides hands-on support to application teams adopting standards and tooling, ensuring that the secure path is also the easy and default path.

Charts the enterprise course through the rapidly evolving field of AI-assisted software development, establishing the technical strategy and guardrails for safe adoption of AI coding assistants, agentic coding tools, and AI-generated code across the engineering organization; evaluating and integrating AI-native application security tooling (AI-assisted triage, autofix, secure code review, threat modeling, and detection engineering); and helping the enterprise navigate emerging risks including insecure generated code, prompt injection in developer workflows, model and prompt supply-chain exposure, and IP/data leakage through AI tooling.

Partners with the Developer Experience team to design and deliver the developer-facing side of the program, secure-by-default paved paths, secure coding standards mapped to OWASP ASVS and NIST SSDF, and outcome-based metrics that translate application security posture into business risk. Partners closely with the Developer Experience team that manages the enterprise CI/CD pipelines, and with Security Engineering peers across Cloud Security, AI Security, Identity, Detection Engineering, and Exposure Management, to ensure application security controls are integrated end-to-end from developer laptop to production runtime. Operates as a trusted bridge between deeply technical engineering teams and business stakeholders, influencing strategy, investment, and execution across organizational boundaries without relying on direct authority.

*This role can work remotely from anywhere in the continental USA.
Required Qualifications

• 15+ years of experience in technical roles, with demonstrated ability to influence without authority across technical and executive audiences
• 10+ years of experience acting as a bridge between deep technical work and business strategy, translating between the two fluently
• 10+ years of hands-on software engineering experience across multiple language ecosystems (e.g., Java, C#, JavaScript/TypeScript, Python, Go) — with recent, current coding proficiency, not solely architectural or advisory experience
• 8+ years in application security or product security roles at enterprise scale, including hands-on experience with threat modeling, secure design review, secure code review, and vulnerability triage
• 5+ years setting multi-year technical strategy and architectural roadmaps for enterprise-scale application security or DevSecOps programs
• Deep working knowledge of the modern application security tooling landscape — SAST, DAST, SCA, IAST/RASP, secrets scanning, API security, container and IaC scanning, ASPM/ASOC — including hands-on experience selecting, integrating, tuning, and operating these tools at enterprise scale
• Demonstrated experience integrating security controls into modern CI/CD pipelines and developer platforms (Git-based workflows, GitHub Actions / GitLab CI / Jenkins / Argo, container registries, artifact repositories, service catalogs) as native, low-friction platform capabilities
• Strong working knowledge of software supply chain security — SBOMs (CycloneDX, SPDX), the SLSA framework, provenance and attestation, dependency and license governance, and build-system hardening
• Deep familiarity with cloud-native architectures (Kubernetes, serverless, microservices), API design patterns (REST, GraphQL, gRPC, event-driven), and the security implications of each
• Demonstrated experience leading the transformation of an application security program from centralized, gate-oriented, meeting-driven workflows to developer-native, control-driven, continuous operations — including measurable improvements in adoption, remediation velocity, and defect escape rate
• Demonstrated experience partnering with platform engineering or developer experience teams to deliver security capabilities as native platform features rather than external gates
• Strong written and verbal communication, including proven experience briefing executive leadership and the board

Preferred Qualifications

• Practical, current experience with AI-assisted software development — evaluating and governing AI coding assistants (e.g., Claude Code, GitHub Copilot, Cursor, Windsurf, Cody, Amazon Q Developer, and equivalents), agentic coding tools, and MCP-based developer integrations — including security guardrails and organizational rollout patterns
• Hands-on experience evaluating and integrating AI-native application security tooling — AI-assisted triage, autofix, secure code review, and AI threat modeling capabilities — with practical awareness of accuracy, false-positive, and prompt-injection concerns
• Deep working knowledge of OWASP LLM Top 10, OWASP AI Security & Privacy Guide, MITRE ATLAS, and NIST AI RMF as they apply to application security
• Experience with Application Security Posture Management (ASPM) platforms and unified security signal aggregation, correlation, and prioritization across the AppSec toolchain
• Healthcare-sector application security experience: PHI-handling clinical and pharmacy systems, HIPAA Security Rule, FDA pre-market and post-market cybersecurity guidance (including SPDF), retail pharmacy PCI-scoped applications, and clinical-system safety considerations
• Experience operating application security programs simultaneously against HIPAA, HITRUST CSF, PCI DSS 4.0, the SEC cyber-incident disclosure rule, and NIST CSF 2.0
• Experience with runtime application security capabilities — RASP, eBPF-based runtime protection, service mesh security, and WAF/API gateway integration — and with correlating runtime signals back to source code and design
• Experience partnering with product management, engineering leadership, and platform engineering to embed security into developer workflows without slowing delivery velocity
• Experience influencing standards bodies, open-source projects, or industry working groups relevant to application security or secure software development
• Industry certifications such as CISSP, CSSLP, OSWE, OSCP, GIAC (e.g., GWEB, GWAPT, GMOB, GCSA), or equivalent
• Advanced degree in Computer Science, Software Engineering, or related technical field
• Open-source, publication, or community contribution in application security, DevSecOps, secure software development, or AI-assisted development
• Advanced degree in Computer Science

Education

Bachelor's degree in Computer Science, Engineering, or a related field or related experience.
 

Pay Range

The typical pay range for this role is:

This pay range represents the base hourly rate or base annual full-time salary for all positions in the job grade within which this position falls.  The actual base salary offer will depend on a variety of factors including experience, education, geography and other relevant factors.  This position is eligible for a CVS Health bonus, commission or short-term incentive program in addition to the base pay range listed above.  This position also includes an award target in the company’s equity award program. 
 

Our people fuel our future. Our teams reflect the customers, patients, members and communities we serve and we are committed to fostering a workplace where every colleague feels valued and that they belong.

Great benefits for great people

We take pride in offering a comprehensive and competitive mix of pay and benefits that reflects our commitment to our colleagues and their families.

Additional details about available benefits are provided during the application process and on Benefits Moments.

Qualified applicants with arrest or conviction records will be considered for employment in accordance with all federal, state and local laws.