Staff Application Security Engineer – Threat Research

Secure modern healthcare technology by applying application security engineering and threat research across cloud and enterprise environments.

Responsibilities

• Implement and support application security standards, policies, and best practices
• Partner with engineering teams to integrate security into design, development, testing, and deployment
• Promote secure coding practices and help teams remediate security findings
• Contribute to security automation initiatives to improve efficiency and scalability
• Research emerging threats, vulnerabilities, attack techniques, and security trends
• Perform application security assessments, threat modeling, and vulnerability analysis
• Evaluate security risks and provide actionable recommendations to engineering teams
• Leverage threat intelligence to enhance application security controls and detection capabilities
• Design, configure, and support security technologies across cloud and enterprise environments
• Assist in implementing and managing security controls that protect applications, APIs, and data
• Support vulnerability management and remediation programs
• Contribute to scalable and resilient security architectures
• Work closely with software engineers, architects, platform teams, and security stakeholders
• Participate in design reviews to incorporate security requirements early in the development lifecycle
• Communicate technical security findings to technical and non-technical audiences
• Participate in security investigations and incident response activities as needed
• Support operational security functions across cloud and enterprise environments
• Assist in identifying root causes and implementing long-term remediation strategies
• Serve as a technical mentor for engineers and application security practitioners
• Share knowledge through training sessions, presentations, and documentation
• Contribute to building a culture of security awareness and continuous learning
• Evaluate emerging security tools and technologies
• Contribute to security research initiatives and proof-of-concept efforts
• Recommend process improvements to strengthen application security program effectiveness

Requirements

• 7+ years of experience in application security, information security, software engineering, or related roles
• 5+ years of experience with programming or scripting languages such as Java, Python, JavaScript, C#, C/C++, PowerShell, or Shell scripting
• 3+ years of experience securing public cloud environments including AWS, Azure, or Google Cloud Platform
• 3+ years of experience with container technologies including Docker and Kubernetes
• 3+ years of experience with Infrastructure as Code or Security as Code practices
• 3+ years of experience performing application security assessments, vulnerability analysis, and threat modeling

Technologies

• Java
• Python
• JavaScript
• C#
• C/C++
• PowerShell
• Shell scripting
• AWS
• Azure
• Google Cloud Platform
• Docker
• Kubernetes
• Infrastructure as Code
• Security as Code
• Public cloud environments

Benefits

• Medical, dental, and vision coverage
• Paid time off
• Retirement savings options
• Wellness programs
• Comprehensive benefits package (eligibility-based)

Preferred Qualifications

• Experience implementing data protection controls and supporting compliance requirements
• Experience working with web application security technologies including Web Application Firewalls and API security solutions
• Experience providing security guidance and remediation recommendations to development teams
• Experience designing and implementing security solutions within cloud-native environments
• Knowledge of application security testing methodologies and industry frameworks
• Understanding of network security fundamentals and cloud networking concepts
• Experience with DevSecOps platforms, CI/CD pipelines, and security automation
• Familiarity with compliance and regulatory frameworks such as HIPAA, HITRUST, PCI DSS, NIST, or CSA
• Experience supporting security for data platforms, analytics environments, or technologies such as Snowflake
• Knowledge of threat intelligence, attack simulation, and offensive security concepts
• Experience contributing to security communities, research, presentations, blogs, or open-source initiatives
• Ability to influence technical decisions across multiple engineering teams without direct authority

Pay Range

• Typical pay range: $106,605 - $284,280 per year
• Eligible for a CVS Health bonus, commission, or short-term incentive program in addition to the base pay range listed above
• Includes an award target in the company’s equity award program

Additional Details

• Location: Trenton, NJ (onsite)
• Application window closes: 10/27/2026
• Qualified applicants with arrest or conviction records will be considered for employment in accordance with federal, state, and local laws