Application Security Program Manager

Knowledge Services is hiring a remote Application Security Program Manager (contract) to help the State of Maine transition and sustain application security practices within the SSDLC.

Responsibilities

• Support the Information Security Office in transitioning the State’s secure software development lifecycle (SSDLC) from near-complete modernization to a sustained operating program.
• Coordinate the people, decisions, workflows, and measures needed to make application security practices workable across State technology teams.
• Shift from transition activities to adoption, performance, risk reduction, and continuous improvement across the application security portfolio.
• Lead a cross-functional program management effort across application security stakeholders.
• Partner with Vulnerability Management, Security Architecture, Governance Risk and Compliance (GRC), Application Development, GitHub Governance, infrastructure and platform teams, agency product owners, and vendors.
• Drive follow-through, adoption, and accountability across stakeholders, escalating decisions to the appropriate owner while specialist teams retain authority for technical, product, and risk approvals.
• Oversee application security efforts across multiple teams to improve the State of Maine’s security posture.
• Coordinate handoff from project deliverables to owned processes, including named owners, documented handoffs, decision paths, service expectations, and an operating cadence.
• Maintain a program roadmap covering priorities, dependencies, risks, and an improvement backlog.
• Validate and improve the application risk profile and security workflows, including design review, scanning, finding triage, remediation, exceptions, and release workflows.
• Ensure guidance aligns with real tools, different applications, and vendor models.
• Plan rollout waves with development and platform partners; support security champions, training, office hours, and developer-facing guidance.
• Collect feedback and remove barriers that prevent teams from consistently applying the workflow.
• Help product and development teams convert findings into risk-ranked plans with owners, target dates, and closure evidence.
• Track coverage gaps, aging findings, blockers, and escalations while responsible teams remediate and verify results.
• Facilitate working groups and leadership reviews; maintain a responsibility model; route design questions through Security Architecture and policy, exception, and risk decisions through GRC and authorized Information Security Office leadership.
• Define measures with data owners and coordinate trustworthy reporting on application coverage, adoption, remediation, exceptions, and control performance; use trends and stakeholder feedback to propose changes and adjust priorities.
• Coordinate related initiatives across repository governance, security tooling, platform integration, third-party application security, and developer enablement.
• Surface capacity, funding, and service dependencies; prepare concise options and recommendations for leadership.

Requirements

• 8 to 10 years of experience in leadership roles and cybersecurity program management, including change agent work improving application security program maturity.
• Experience improving application security program maturity.
• Stakeholder Management and Organizational Change Management leadership.
• Working knowledge of Secure Software Development Lifecycle (SSDLC).
• Certification in code and dependency scanning.
• Strong facilitation, writing, and stakeholder communication skills.
• Substantial experience managing complex technology, cybersecurity, or application security programs across multiple teams, delivering through influence and shared accountability.
• Knowledge of software delivery and application security concepts, including security requirements, code and dependency scanning, vulnerability management, remediation, and risk treatment.
• Ability to translate technical and policy issues into clear actions, owners, decisions, and management reporting.
• Experience establishing repeatable processes, coordinating organizational change, using measures to improve performance, and managing competing priorities in an evolving program.
• Experience implementing, operationalizing, or governing SSDLC practices across multiple development teams.

Tech Stack

• Secure software development lifecycle (SSDLC)
• GitHub
• Governance Risk and Compliance (GRC)

Additional Details

• Location: United States (remote)
• Contract: through end of June 2027 (likely extension)
• Time zone: remote work acceptable for candidates residing in EST or CST time zones
• Work eligibility: cannot accept candidates requiring C2C or requiring sponsorship for a work visa

Why This Role

• Impact the trajectory of application security in the State of Maine by supporting integrity and confidentiality of critical systems.
• Work within a large IT enterprise supporting critical State applications.
• Contribute to protecting citizens’ data and enabling secure operation of essential government services.

Why Candidates May Like It

• Immersion in rapidly evolving state government issues with a fast-moving organization.
• Collaboration with peers and exposure to creative problem-solving approaches.
• Opportunities to tackle unique and complex projects in application security.