Application Security Program Manager; remote

Knowledge Services is seeking an Application Security Program Manager (remote) for a contract through the end of June 2027 (likely for extension) with the State of Maine Office of Technology.

• Applicants are able to work remotely provided they reside in the EST or CST time zones
• Please note that we cannot accept any candidates requiring C2C or those requiring sponsorship for a work visa.

• The Application Security Program Manager supports the Information Security Office in transitioning the State’s secure software development lifecycle (SSDLC) from a near-complete modernization project to a sustained operating program.
• The position coordinates the people, decisions, workflows, and measures needed to make application security practices workable across State technology teams.
• As initial transition tasks are completed, the manager shifts effort to adoption, performance, risk reduction, and continuous improvement across the broader application security portfolio.
• This is a cross-functional program management role.
• The manager works with Vulnerability Management, Security Architecture, Governance Risk and Compliance (GRC), Application Development, Git Hub Governance, infrastructure and platform teams, agency product owners, and vendors.
• The manager drives follow-through, program adoption, and accountability across stakeholders and elevates decisions to the appropriate owner; specialist teams retain their established technical, product, and risk approval authority.
• This role requires the ability to oversee application security efforts across multiple teams and drive program improvements to strengthen the State of Maine’s security posture.
• We seek a self-motivated individual who thrives in fast-paced environments, seamlessly drives initiatives with multiple stakeholders, and has demonstrable experience in application security leadership.

• Coordinate transition from project deliverables to owned processes, including named owners, documented handoffs, decision paths, service expectations, and a practical operating cadence.
• Maintain the program roadmap, priorities, dependencies, risks, and improvement backlog.
• Work with accountable teams to validate and improve the application risk profile, security requirements, design review, scanning, finding triage, remediation, exception, and release workflows.
• Ensure guidance reflects real tools and different applications and vendor models.
• Plan rollout waves with development and platform partners; support security champions, training, office hours, and clear developer-facing guidance.
• Gather feedback and remove barriers that prevent teams from applying the workflow consistently.
• Help product and development teams turn findings into risk-ranked plans with owners, target dates, and closure evidence.
• Track coverage gaps, aging findings, blockers, and escalations while the responsible teams perform remediation and verification.
• Facilitate working groups and leadership reviews, maintain an accurate responsibility model, and route design questions to Security Architecture and policy, exception, and risk decisions through GRC and authorized Information Security Office leadership.
• Define useful measures with data owners; coordinate trustworthy reporting on application coverage, adoption, remediation, exceptions, and control performance. Use trends and team feedback to propose changes, report progress, and adjust priorities.
• Coordinate related initiatives in repository governance, security tooling, platform integration, third-party application security, and developer enablement.
• Surface capacity, funding, and service dependencies; prepare concise options and recommendations for leadership.