AVP Cybersecurity

Ensemble RCM LLC is hiring an AVP, Application Security (Dev Sec Ops ) to build, run, and continually mature the organization’s application security program. This is a working, hands‑on leadership role that combines ownership of secure SDLC strategy and application‑layer vulnerability management with direct technical work, mentoring, and executive reporting of application risk posture.

• Build, lead, and continuously improve a comprehensive App Sec and Dev Sec Ops  program covering secure SDLC,
  SAST/DAST/SCA
  , container and cloud‑native security, and API security
  .
• Remain a working, hands‑on team member by performing secure code reviews,
  threat modeling
  , security architecture reviews, and hands‑on remediation guidance alongside engineers.
• Mentor and develop application security engineers and embedded security champions through technical guidance, pairing on complex issues, and strengthening the team’s long‑term capability.
• Design, implement, and tune the App Sec toolchain (such as SAST, DAST, SCA, container scanning, and secrets detection) and integrate security gates into CI/CD pipelines in partnership with engineering teams.
• Own application vulnerability management, including triage, prioritization,
  remediation SLAs
  , escalation of critical findings, and personally leading response on high‑severity issues.
• Partner with engineering, product, and architecture teams to embed security requirements and threat modeling into the design phase of new products and features (“shift-left”).
• Develop and maintain application security policies, secure coding standards, and Dev Sec Ops  playbooks, and train engineering staff on secure development practices.
• Manage third‑party and open‑source risk through software composition analysis and remediation of vulnerable dependencies.
• Report application security risk posture, program metrics, and remediation trends to executive leadership and other stakeholders.
• Participate in application‑level security incident response, including root cause analysis and remediation planning.

• 8+ years of experience in application security, secure software development, or Dev Sec Ops , including hands‑on engineering or security engineering work.
• 3+ years in a leadership or technical lead capacity, with evidence of staying hands‑on while leading or mentoring a team.
• Relevant certification preferred, such as CSSLP, OSCP, GWAPT, or CISSP
  .
• Familiarity with frameworks including OWASP ASVS, OWASP Top 10, and NIST SSDF
  .
• Hands‑on experience with SAST, DAST, and SCA tools and the ability to configure, tune, and troubleshoot them directly (examples include Checkmarx, Veracode, Snyk, Semgrep, Fortify
  ).
• Working proficiency in one or more programming languages sufficient for secure code review and automation/tooling (examples:
  Java, Python, JavaScript/Type Script, Go, C#).
• Experience integrating security into CI/CD and Dev Ops tool chains (examples:
  Jenkins, Git Hub Actions, Git Lab CI, Azure Dev Ops
  ).
• Experience with cloud security and container/orchestration security (examples:
  AWS, Azure, GCP; Docker, Kubernetes
  ).
• Experience conducting threat modeling (examples:
  STRIDE
  ) and security architecture reviews.
• Experience building and scaling a vulnerability management program, including remediation SLAs and executive reporting.
• Strong communication and presentation skills to translate technical risk for non‑technical stakeholders.
• Ability to work independently, lead a highly skilled App Sec team, and remain a credible technical practitioner.
• Strong analytical and critical thinking skills with the ability to prioritize under pressure and meet deadlines.
• Demonstrated inquisitiveness and openness to innovation, including AI, to improve processes and reduce friction while improving patient…