Application Security Program Manager

Top Skills:

8 to 10 years of experience in leadership roles and cybersecurity program management.

Experience improving application security program maturity.

Stakeholder Management and Organizational Change Management Leadership.

Secure Software Development Lifecycle (SSDLC).

Preferred Skills

Certification: Code and dependency scanning.

Skill: Strong facilitation, writing, and stakeholder communication skills.

JOB DESCRIPTION:

The Application Security Program Manager (Business SME 1) supports the Information Security Office in transitioning the State’s secure software development lifecycle (SSDLC) from a near-complete modernization project to a sustained operating program. The position coordinates the people, decisions, workflows, and measures needed to make application security practices workable across State technology teams. As initial transition tasks are completed, the manager shifts effort to adoption, performance, risk reduction, and continuous improvement across the broader application security portfolio.

This is a cross-functional program management role. The manager works with Vulnerability Management, Security Architecture, Governance Risk and Compliance (GRC), Application Development, GitHub Governance, infrastructure and platform teams, agency product owners, and vendors. The manager drives follow-through, program adoption, and accountability across stakeholders and elevates decisions to the appropriate owner; specialist teams retain their established technical, product, and risk approval authority.

MINIMUM QUALIFICATIONS:

The manager in this role requires the ability to oversee application security efforts across multiple teams and drive program improvements to strengthen the State of Maine’s security posture. We seek a self-motivated individual who thrives in fast-paced environments, seamlessly drives initiatives with multiple stakeholders, and has demonstrable experience in application security leadership. The candidate must have 8 to 10 years of experience in leadership roles, program management, and change agent roles, improving application security program maturity.

PREFERRED QUALIFICATIONS:

Substantial experience managing complex technology, cybersecurity, or application security programs across multiple teams, with demonstrated delivery through influence and shared accountability.

Working knowledge of software delivery and application security concepts, including security requirements, code and dependency scanning, vulnerability management, remediation, and risk treatment.

Ability to translate technical and policy issues into clear actions, owners, decisions, and management reporting; strong facilitation, writing, and stakeholder communication skills.

Experience establishing repeatable processes, coordinating organizational change, using measures to improve performance, and managing competing priorities in an evolving program.

Experience implementing, operationalizing, or governing Secure Software Development Lifecycle (SSDLC) practices across multiple development teams.