This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an Application Security Program Manager based in the United States.
The Application Security Program Manager will lead the transition of an enterprise application security initiative into a sustainable, operational program, strengthening security practices across a complex technology environment. This role focuses on improving the adoption and effectiveness of the Secure Software Development Lifecycle (SSDLC), coordinating stakeholders, and driving continuous improvement. You will work across security, software development, infrastructure, governance, and platform teams to establish consistent processes and clear accountability. By translating technical risks and organizational priorities into actionable plans, you will help improve application security maturity and reduce exposure across critical systems. This remote contract opportunity runs through the end of June 2027, with a likely extension, and requires candidates to reside in the Eastern or Central time zone.
Accountabilities
• Coordinate the transition from project-based deliverables to sustainable, clearly owned application security processes, including documented handoffs, decision-making pathways, service expectations, and operating routines.
• Maintain the program roadmap, priorities, dependencies, risks, and continuous improvement backlog.
• Collaborate with security, development, infrastructure, platform, and governance teams to improve application risk assessments, security requirements, design reviews, scanning, vulnerability triage, remediation, exceptions, and release workflows.
• Plan and coordinate phased rollouts with development and platform teams, supporting security champions, developer training, office hours, and practical security guidance.
• Gather stakeholder feedback, identify adoption barriers, and drive consistent implementation of security practices across diverse applications, tools, and vendor environments.
• Help development and product teams establish risk-prioritized remediation plans with clear ownership, deadlines, and evidence of resolution.
• Monitor application coverage gaps, aging vulnerabilities, blockers, and escalations while coordinating with the teams responsible for remediation and verification.
• Facilitate cross-functional working groups and leadership reviews, clarify responsibilities, and ensure technical design questions and policy or risk decisions reach the appropriate authorities.
• Define meaningful program metrics with data owners and coordinate reliable reporting on coverage, adoption, remediation progress, exceptions, and control effectiveness.
• Analyze performance trends, recommend improvements, and adjust priorities to strengthen security outcomes and program maturity.
• Coordinate related initiatives involving repository governance, security tools, platform integration, third-party application security, and developer enablement.
• Identify capacity, funding, and service dependencies, and prepare clear recommendations and decision options for leadership.
Requirements:
• 8–10 years of experience in leadership, cybersecurity program management, organizational change, or related roles, with a demonstrated track record of improving application security program maturity.
• Experience managing complex technology, cybersecurity, or application security programs across multiple teams, driving delivery through influence, collaboration, and shared accountability.
• Strong understanding of the Secure Software Development Lifecycle (SSDLC), including experience implementing, operationalizing, or governing secure development practices across multiple teams.
• Working knowledge of application security and software delivery concepts, including security requirements, code and dependency scanning, vulnerability management, remediation workflows, and risk treatment.
• Proven stakeholder management and organizational change leadership skills, with the ability to coordinate competing priorities in a dynamic environment.
• Experience establishing repeatable processes, defining responsibilities, measuring performance, and using data and feedback to drive continuous improvement.
• Strong facilitation, written communication, and interpersonal skills, including the ability to translate technical and policy issues into clear actions, ownership, decisions, and management reporting.
• Ability to work independently, navigate complex stakeholder environments, identify barriers, and maintain accountability without assuming technical or risk-approval responsibilities assigned to specialist teams.
• Preferred: Relevant certifications or training in code scanning and dependency scanning.
• Must reside in the Eastern or Central time zone to meet remote work requirements.
• Must be authorized to work without requiring visa sponsorship; candidates requiring a C2C arrangement or work visa sponsorship cannot be considered.
Benefits:
• Remote work arrangement for candidates residing in the Eastern or Central time zone.
• Contract engagement through the end of June 2027, with a likely extension.
• Opportunity to influence application security strategy and improve the maturity of a large, complex technology environment.
• Meaningful work supporting the protection, confidentiality, and integrity of critical public-sector systems and sensitive citizen data.
• Collaboration with experienced professionals across cybersecurity, software development, infrastructure, governance, and technology operations.
• Exposure to complex application security challenges, evolving government technology priorities, and opportunities for professional growth.
• Opportunity to drive practical security improvements, strengthen organizational resilience, and contribute to the delivery of more secure digital services.
How Jobgether works:
We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.
We appreciate your interest and wish you the best!
Why Apply Through Jobgether?
Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.