CVS Health
Distinguished Engineer - Application Security
$175K–$335K
AZ - Work from home · Remote · Principal · Full-time · Posted Sep 23, 2026
- Experience
- 15+ years technical roles; 10+ years hands-on software engineering and bridging technical work with business strategy; 8+ years application or product security; 5+ years setting enterprise AppSec or DevSecOps strategy and roadmaps.
- Education
- Bachelor's degree in Computer Science, Engineering, or a related field or related experience.
About the job
Sets enterprise application security strategy and architecture, embedding security controls across developer workflows, CI/CD pipelines, and production systems while guiding secure adoption of AI-assisted development.
What you'll do
- Own the technical strategy, architecture, and integration of enterprise application security tools and developer-platform capabilities.
- Lead application security program transformation, including secure-by-default standards, continuous controls, and outcome-based metrics.
- Set guardrails for AI coding tools and AI-generated code, and evaluate AI-native application security tooling.
What they ask for
- 15+ years in technical roles and demonstrated ability to influence technical and executive audiences without authority.
- 10+ years of hands-on software engineering across multiple language ecosystems, with current coding proficiency.
- 8+ years in enterprise-scale application or product security, including threat modeling, secure design and code review, and vulnerability triage.
- Experience setting multi-year AppSec strategy and integrating security tools and controls into enterprise CI/CD and developer platforms.
Nice to have
- Current experience governing AI coding assistants, agentic coding tools, or AI-native application security tooling.
- Healthcare-sector application security experience or relevant industry certifications.
Pay
$175,100.00 - $334,750.00 USD base salary
Tools
SAST, DAST, SCA, IAST/RASP, ASPM/ASOC, CI/CD, Kubernetes, GitHub Actions
AI focus
Establishes guardrails for AI coding assistants, agentic coding tools, and AI-generated code; evaluates AI-native security tooling and addresses risks such as insecure generated code, prompt injection, supply-chain exposure, and IP or data leakage.
Model-written summary · the original posting is authoritative