AVP Cybersecurity

Ensemble RCM LLC is hiring an AVP, Application Security (DevSecOps) to build, run, and continually mature the organization’s application security program. This is a working, hands-on leadership role that combines ownership of secure SDLC strategy and application-layer vulnerability management with direct technical work, mentoring, and executive reporting of application risk posture.

What you’ll do

• Build, lead, and continuously improve a comprehensive AppSec and DevSecOps program covering secure SDLC, SAST/DAST/SCA, container and cloud-native security, and API security.
• Remain a working, hands-on team member by performing secure code reviews, threat modeling, security architecture reviews, and hands-on remediation guidance alongside engineers.
• Mentor and develop application security engineers and embedded security champions through technical guidance, pairing on complex issues, and strengthening the team’s long-term capability.
• Design, implement, and tune the AppSec toolchain (such as SAST, DAST, SCA, container scanning, and secrets detection) and integrate security gates into CI/CD pipelines in partnership with engineering teams.
• Own application vulnerability management, including triage, prioritization, remediation SLAs, escalation of critical findings, and personally leading response on high-severity issues.
• Partner with engineering, product, and architecture teams to embed security requirements and threat modeling into the design phase of new products and features (“shift-left”).
• Develop and maintain application security policies, secure coding standards, and DevSecOps playbooks, and train engineering staff on secure development practices.
• Manage third-party and open-source risk through software composition analysis and remediation of vulnerable dependencies.
• Report application security risk posture, program metrics, and remediation trends to executive leadership and other stakeholders.
• Participate in application-level security incident response, including root cause analysis and remediation planning.

What you bring

• 8+ years of experience in application security, secure software development, or DevSecOps, including hands-on engineering or security engineering work.
• 3+ years in a leadership or technical lead capacity, with evidence of staying hands-on while leading or mentoring a team.
• Relevant certification preferred, such as CSSLP, OSCP, GWAPT, or CISSP.
• Familiarity with frameworks including OWASP ASVS, OWASP Top 10, and NIST SSDF.
• Hands-on experience with SAST, DAST, and SCA tools and the ability to configure, tune, and troubleshoot them directly (examples include Checkmarx, Veracode, Snyk, Semgrep, Fortify).
• Working proficiency in one or more programming languages sufficient for secure code review and automation/tooling (examples: Java, Python, JavaScript/TypeScript, Go, C#).
• Experience integrating security into CI/CD and DevOps toolchains (examples: Jenkins, GitHub Actions, GitLab CI, Azure DevOps).
• Experience with cloud security and container/orchestration security (examples: AWS, Azure, GCP; Docker, Kubernetes).
• Experience conducting threat modeling (examples: STRIDE) and security architecture reviews.
• Experience building and scaling a vulnerability management program, including remediation SLAs and executive reporting.
• Strong communication and presentation skills to translate technical risk for non-technical stakeholders.
• Ability to work independently, lead a highly skilled AppSec team, and remain a credible technical practitioner.
• Strong analytical and critical thinking skills with the ability to prioritize under pressure and meet deadlines.
• Demonstrated inquisitiveness and openness to innovation, including AI, to improve processes and reduce friction while improving patient and client experiences.
• Remote role with willingness and ability to travel and work onsite at client, temporary, or corporate office locations as business needs require.
• Residency and authorization to work within the United States only.

Technologies you’ll work with

• SAST, DAST, SCA, container scanning, secrets detection
• CI/CD pipelines and CI/CD
• AppSec, software composition analysis
• Snyk, Semgrep, Fortify, Checkmarx, Veracode
• Java, Python, JavaScript/TypeScript, Go, C#
• Jenkins, GitHub Actions, GitLab CI, Azure DevOps
• AWS, Azure, GCP; Docker, Kubernetes
• STRIDE, OWASP ASVS, OWASP Top 10, NIST SSDF
• CSSLP, OSCP, GWAPT, CISSP

Location and compensation

• Location: Blue Ash, OH (remote)
• Salary: USD 171,750 - 257,700 per year
• Minimum experience: 3+ years

Benefits

• Associate benefits package covering physical, emotional, and financial health, including healthcare, time off, retirement, and well-being programs.
• Professional certification support and tuition reimbursement.
• Quarterly and annual incentive programs.

Job competencies

• Valuing Differences
• Collaboration
• Accountability
• Time Management
• Developing Trust
• Takes Initiative