Service Owner - Application Security, SDLC & Security Architecture

The Service Owner for Application Security, SDLC & Security Architecture is responsible for shaping and governing enterprise application security capabilities. This onsite role in the United States focuses on strategy, secure software development practices, security architecture alignment, and continuous improvement across multiple organizational portfolios.

Key Responsibilities

• Define and maintain the enterprise application security strategy, roadmap, and future-state capability model.
• Own and continuously improve secure SDLC practices across Research & Development, Commercial, and Corporate application environments.
• Establish security governance processes for application development, enhancement, and support activities.
• Own the security architecture review process and provide governance for application security design decisions.
• Partner with solution architects, application owners, developers, and business stakeholders to identify security risks and recommend appropriate security controls.
• Define and govern application security testing practices, including security assessments, vulnerability testing, application security reviews, penetration testing coordination, and security validation activities.
• Establish application security standards, documentation requirements, and reusable security patterns.
• Support application teams across the lifecycle, including design, development, implementation, and ongoing support.
• Evaluate application security tools and recommend improvements to enhance security effectiveness and the developer experience.
• Drive adoption of secure engineering practices and security-by-design principles.
• Define service KPIs, maturity objectives, and continuous improvement initiatives.
• Ensure application security capabilities align with regulatory, privacy, and healthcare requirements, including HIPAA where applicable.

Required Experience & Qualifications

• 10+ years of experience in application security, cybersecurity, software engineering, or security architecture.
• Experience owning enterprise application security capabilities across multiple business domains.
• Experience supporting application portfolios within complex organizations, including R&D, Commercial, and Corporate environments.
• Strong understanding of secure SDLC practices.
• Strong understanding of security architecture reviews.
• Strong understanding of application security testing methodologies.
• Strong understanding of vulnerability management.
• Strong understanding of DevSecOps principles.
• Strong understanding of application risk management.
• Experience partnering with development teams, architects, and business stakeholders.
• Experience defining security standards, governance processes, and operating models.
• Experience working in regulated environments; healthcare experience and knowledge of HIPAA/security controls is preferred.
• IT security

Must-Have Skill

• IT security