Business SME; Senior

Application Security Program Manager

Location: Remote, U.S. | Eastern or Central Time Zones

Work Arrangement: 100% remote for most candidates; candidates residing in Maine may have periodic onsite requirements

Experience: 8–10 years in leadership, cybersecurity program management, and organizational change

Compensation: $66-68 per hour with benefits

Contract: W2, 1 year ongoing

Epitec is seeking an experienced Application Security Program Manager to help transition a modernized Secure Software Development Lifecycle (SSDLC) into a sustainable, enterprise-wide operating program.

This is a highly cross‑functional leadership role focused on application security maturity, stakeholder management, organizational change, risk reduction, and continuous improvement. The ideal candidate combines strong cybersecurity program leadership with working knowledge of application security and modern software development practices.

• Lead the transition of SSDLC initiatives from project deliverables into sustainable, repeatable operating processes.
• Maintain program roadmaps, priorities, dependencies, risks, ownership models, and continuous‑improvement backlogs.
• Partner with Vulnerability Management, Security Architecture, GRC, Application Development, platform teams, product owners, and vendors.
• Improve application security workflows covering security requirements, design reviews, scanning, vulnerability triage, remediation, exceptions, and release processes.
• Plan adoption and rollout initiatives across development and platform teams.
• Support security champions, training, office hours, and developer‑facing security guidance.
• Help development and product teams translate security findings into risk‑ranked remediation plans with clear owners and target dates.
• Track application coverage, aging findings, remediation progress, blockers, exceptions, and escalations.
• Facilitate cross‑functional working groups and leadership reviews.
• Develop meaningful program measures and coordinate reporting on adoption, remediation, application coverage, exceptions, and control performance.
• Coordinate related initiatives involving repository governance, security tooling, platform integrations, third‑party application security, and developer enablement.
• Identify resource, capacity, service, and funding dependencies and develop clear recommendations for leadership.

• 8–10 years of experience in leadership, cybersecurity program management, and/or organizational change roles.
• Demonstrated experience improving application security program maturity.
• Strong experience with Secure Software Development Lifecycle (SSDLC) practices.
• Proven ability to manage complex, cross‑functional technology or cybersecurity programs.
• Strong stakeholder management and organizational change leadership skills.
• Working knowledge of application security concepts, including:
• Security requirements
• Code and dependency scanning
• Vulnerability management
• Finding triage and remediation
• Risk treatment and exception processes
• Ability to turn technical, security, and policy issues into clear decisions, actions, owners, and executive‑level reporting.
• Excellent facilitation, written communication, and stakeholder communication skills.
• Experience establishing repeatable processes, measuring program performance, and managing competing priorities.

• Implementing, operationalizing, or governing SSDLC practices across multiple development teams.
• Application security governance in a large, complex technology environment.
• Coordinating security initiatives across technical teams that maintain separate decision‑making and approval responsibilities.
• Using metrics, stakeholder feedback, and risk trends to continuously improve application security programs.

The position is 100% remote for candidates located in the Eastern or Central time zones, with an exception for candidates residing in Maine. Maine‑based candidates may be required to work onsite one day every two weeks, and related travel expenses are not reimbursed.

The selected candidate must successfully complete required pre‑employment background checks and meet applicable credentials and onboarding requirements.

#INDPRO