Application Security Program Manager.

Accountabilities

• Coordinate the transition from project-based deliverables to sustainable, clearly owned application security processes, including documented handoffs, decision-making pathways, service expectations, and operating routines.

• Maintain the program roadmap, priorities, dependencies, risks, and continuous improvement backlog.

• Collaborate with security, development, infrastructure, platform, and governance teams to improve application risk assessments, security requirements, design reviews, scanning, vulnerability triage, remediation, exceptions, and release workflows.

• Plan and coordinate phased rollouts with development and platform teams, supporting security champions, developer training, office hours, and practical security guidance.

• Gather stakeholder feedback, identify adoption barriers, and drive consistent implementation of security practices across diverse applications, tools, and vendor environments.

• Help development and product teams establish risk-prioritized remediation plans with clear ownership, deadlines, and evidence of resolution.

• Monitor application coverage gaps, aging vulnerabilities, blockers, and escalations while coordinating with the teams responsible for remediation and verification.

• Facilitate cross-functional working groups and leadership reviews, clarify responsibilities, and ensure technical design questions and policy or risk decisions reach the appropriate authorities.

• Define meaningful program metrics with data owners and coordinate reliable reporting on coverage, adoption, remediation progress, exceptions, and control effectiveness.

• Analyze performance trends, recommend improvements, and adjust priorities to strengthen security outcomes and program maturity.

• Coordinate related initiatives involving repository governance, security tools, platform integration, third-party application security, and developer enablement.

• Identify capacity, funding, and service dependencies, and prepare clear recommendations and decision options for leadership.

Requirements:

• 8–10 years of experience in leadership, cybersecurity program management, organizational change, or related roles, with a demonstrated track record of improving application security program maturity.

• Experience managing complex technology, cybersecurity, or application security programs across multiple teams, driving delivery through influence, collaboration, and shared accountability.

• Strong understanding of the Secure Software Development Lifecycle (SSDLC), including experience implementing, operationalizing, or governing secure development practices across multiple teams.

• Working knowledge of application security and software delivery concepts, including security requirements, code and dependency scanning, vulnerability management, remediation workflows, and risk treatment.

• Proven stakeholder management and organizational change leadership skills, with the ability to coordinate competing priorities in a dynamic environment.

• Experience establishing repeatable processes, defining responsibilities, measuring performance, and using data and feedback to drive continuous improvement.

• Strong facilitation, written communication, and interpersonal skills, including the ability to translate technical and policy issues into clear actions, ownership, decisions, and management reporting.

• Ability to work independently, navigate complex stakeholder environments, identify barriers, and maintain accountability without assuming technical or risk-approval responsibilities assigned to specialist teams.

• Preferred: Relevant certifications or training in code scanning and dependency scanning.

• Must reside in the Eastern or Central time zone to meet remote work requirements.

• Must be authorized to work without requiring visa sponsorship; candidates requiring a C2C arrangement or work visa sponsorship cannot be considered.

Benefits:

• Remote work arrangement for candidates residing in the Eastern or Central time zone.

• Contract engagement through the end of June 2027, with a likely extension.

• Opportunity to influence application security strategy and improve the maturity of a large, complex technology environment.

• Meaningful work supporting the protection, confidentiality, and integrity of critical public-sector systems and sensitive citizen data.

• Collaboration with experienced professionals across cybersecurity, software development, infrastructure, governance, and technology operations.

• Exposure to complex application security challenges, evolving government technology priorities, and opportunities for professional growth.

• Opportunity to drive practical security improvements, strengthen organizational resilience, and contribute to the delivery of more secure digital services.