Note: The job is a remote job and is open to candidates in USA. CVS Health is focused on building a more connected and compassionate health experience. As a Staff Application Security Engineer – Threat Research, you will be responsible for securing healthcare technology through application security engineering and threat research, collaborating with engineering teams to identify and mitigate security risks.
Responsibilities
- Implement and support application security standards, policies, and best practices
- Partner with engineering teams to integrate security into design, development, testing, and deployment processes
- Promote secure coding practices and assist teams in remediating security findings
- Contribute to security automation initiatives that improve efficiency and scalability
- Research emerging threats, vulnerabilities, attack techniques, and security trends
- Perform application security assessments, threat modeling, and vulnerability analysis
- Evaluate risks and provide actionable recommendations to engineering teams
- Leverage threat intelligence to enhance application security controls and detection capabilities
- Design, configure, and support security technologies across cloud and enterprise environments
- Assist with implementation and management of security controls that protect applications, APIs, and data
- Support vulnerability management and remediation programs
- Contribute to the development of scalable and resilient security architectures
- Work closely with software engineers, architects, platform teams, and security stakeholders
- Participate in design reviews to ensure security requirements are incorporated early in the development lifecycle
- Communicate technical security findings to both technical and non-technical audiences
- Participate in security investigations and incident response activities as needed
- Support operational security functions across cloud and enterprise environments
- Assist in identifying root causes and implementing long-term remediation strategies
- Serve as a technical mentor for engineers and application security practitioners
- Share knowledge through training sessions, presentations, and documentation
- Contribute to building a culture of security awareness and continuous learning
- Evaluate emerging security tools and technologies
- Contribute to security research initiatives and proof-of-concept efforts
- Recommend process improvements that strengthen the effectiveness of application security programs
Skills
- 7+ years of experience in application security, information security, software engineering, or related roles
- 5+ years of experience with one or more programming or scripting languages such as Java, Python, JavaScript, C#, C/C++, PowerShell, or Shell scripting
- 3+ years of experience securing public cloud environments including AWS, Azure, or Google Cloud Platform
- 3+ years of experience with container technologies including Docker and Kubernetes
- 3+ years of experience with Infrastructure as Code or Security as Code practices
- 3+ years of experience performing application security assessments, vulnerability analysis, and threat modeling
- Experience implementing data protection controls and supporting compliance requirements
- Experience working with web application security technologies including Web Application Firewalls and API security solutions
- Experience providing security guidance and remediation recommendations to development teams
- Experience designing and implementing security solutions within cloud-native environments
- Knowledge of application security testing methodologies and industry frameworks
- Understanding of network security fundamentals and cloud networking concepts
- Experience with DevSecOps platforms, CI/CD pipelines, and security automation
- Familiarity with compliance and regulatory frameworks such as HIPAA, HITRUST, PCI DSS, NIST, or CSA
- Experience supporting security for data platforms, analytics environments, or technologies such as Snowflake
- Knowledge of threat intelligence, attack simulation, and offensive security concepts
- Experience contributing to security communities, research, presentations, blogs, or open-source initiatives
- Ability to influence technical decisions across multiple engineering teams without direct authority
Benefits
- This position is eligible for a CVS Health bonus, commission or short-term incentive program in addition to the base pay range listed above.
- This position also includes an award target in the company’s equity award program.
- Medical, dental, and vision coverage
- Paid time off
- Retirement savings options
- Wellness programs
- Other resources
- Remote/Hybrid
Company Overview
Company H1B Sponsorship