Application Security Manager

Location: Denver, CO Salary: $120,000.00 USD Annually - $151,000.00 USD Annually Description:
Company: Healthcare

Position: Application Security Manager

Location: Denver, CO

Direct hire/permanent position



No Corp to corp/H1 visa's

JOB SUMMARY

Enterprise Application Portfolio - The Application Security Manager is responsible for leading the organization's Application Security program, ensuring that security is integrated throughout the Application Cycle (SDLC). This role partners closely with the software teams, cloud, architecture, infrastructure, and potentially product teams to identify, assess, and mitigate application security risks while enabling secure software delivery.

The successful candidate will lead a team of application security analysts, establish secure development standards, oversee security testing programs, and drive adoption of security best practices aligned with industry standards such as NIST SP 800-218 (Secure Software Development Framework), NIST Cybersecurity Framework (CSF) 2.0, OWASP, and CIS Controls.

ESSENTIAL DUTIES (or key responsibilities)

Application Security Leadership

Collaborate with other global and regional leaders within to develop the enterprise Application Security strategy.

Lead, mentor, and develop Application Security Analysts.

Define AppSec metrics, KPIs, and maturity goals in collaboration with regional and global security leaders.

Secure Software Lifecycle

Integrate security into all phases of the enterprise application portfolio.

Ensure security requirements are incorporated during design and architecture reviews.

Promote security-by-design principles across application teams.

Security Testing

Manage and oversee:

Static Application Security Testing (SAST)

Dynamic Application Security Testing (DAST)

Software Composition Analysis (SCA)

Interactive Application Security Testing (IAST)

API Security Testing

Container Security

Infrastructure as Code (IaC) Security

Mobile Application Security Testing

Secrets Detection

Review findings, prioritize remediation, and validate fixes.

Assist in Supply Chain Security

Threat Modeling

Facilitate threat modeling sessions with development teams.

Identify abuse cases and attack paths.

Recommend architectural improvements.

Ensure high-risk applications undergo formal security architecture reviews.

Vulnerability Management

Establish application vulnerability management processes

Prioritize remediation using risk-based methodologies

Track remediation SLAs

Report vulnerability metrics to executive leadership

Coordinate penetration testing remediation activities

Threat Intelligence

Cloud Application Security

Support secure development within cloud platforms including:

AWS

Microsoft Azure

Google Cloud Platform

Secure Code Reviews

Conduct manual secure code reviews

Review high-risk applications

Provide secure coding guidance

Coach development teams on remediation

API Security

Establish and set-up safe rules

Find weak spots through testing

Monitor logs to spot shadow APIs and strange traffic patterns

Security Awareness

Collaboration on training programs covering:

OWASP Top 10

Secure Coding

API Security

Cloud Security

Common software vulnerabilities

Secure design principles

Application Risk Management

Perform application security risk assessments.

Support enterprise application risk management initiatives.

Incident Response

Support cyber incident response by:

Investigating application security incidents.

Supporting forensic analysis.

Identifying root causes.

Leading post-incident reviews.

Developing preventive controls.

Compliance

Support compliance initiatives including:

NIST CSF 2.0

NIST SP 800-218 (SSDF)

NIST SP 800-53

OWASP ASVS

PCI DSS

HIPAA

SOX

ISO/IEC 27001

SOC 2

OTHER DUTIES AND RESPONSIBILITIES

MINIMUM QUALIFICATION REQUIREMENTS

Education

Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field.

Master's degree preferred.

Experience

8-10+ years of cybersecurity experience.

5+ years in Application Security.

3+ years leading security teams.

Experience implementing enterprise DevSecOps programs.

Experience working with Agile and CI/CD environments.

Experience with cloud-native application security.

By providing your phone number, you consent to: (1) receive automated text messages and calls from the Judge Group, Inc. and its affiliates (collectively "Judge") to such phone number regarding job opportunities, your job application, and for other related purposes. Message & data rates apply and message frequency may vary. Consistent with Judge's Privacy Policy, information obtained from your consent will not be shared with third parties for marketing/promotional purposes. Reply STOP to opt out of receiving telephone calls and text messages from Judge and HELP for help.
Contact:
This job and many more are available through The Judge Group. Please apply with us today!