Application Security Program Manager

This is a fully remote position, open to applicants in Maine.

📋 Description

• Assist the Information Security Office in transitioning the State’s Secure Software Development Lifecycle (SSDLC) from a modernization initiative to an ongoing operational program.

• Facilitate the coordination of personnel, decision-making, workflows, and metrics necessary to implement application security practices throughout State technology teams.

• Promote adoption, performance enhancement, risk mitigation, continuous improvement, accountability, and follow-through among stakeholders.

• Collaborate with Vulnerability Management, Security Architecture, Governance, Risk, Compliance (GRC), Application Development, GitHub Governance, infrastructure and platform teams, agency product owners, and vendors.

• Oversee the transition from project deliverables to established processes with designated owners, documented handoffs, decision pathways, service expectations, and an operational rhythm.

• Maintain the program roadmap, including priorities, dependencies, risks, and a backlog for improvements.

• Assess and enhance application risk, security requirements, design reviews, scanning protocols, finding triage, remediation, exceptions, and release workflows.

• Plan rollout phases and support security champions, training sessions, office hours, and guidance for developers.

• Collect feedback and eliminate obstacles to workflow adoption.

• Assist teams in formulating risk-ranked remediation strategies with designated owners, target timelines, and closure documentation.

• Monitor coverage gaps, aging findings, obstacles, escalations, and verification of remediation.

• Lead working groups and leadership evaluations; sustain the responsibility model and direct decisions to authorized owners.

• Define metrics and coordinate reports on application coverage, adoption, remediation, exceptions, and control performance.

• Oversee related initiatives in repository governance, security tools, platform integration, third-party application security, and developer empowerment.

• Identify capacity, funding, and service dependencies; prepare options and suggestions for leadership.

⛳️ Requirements

• 8 to 10 years of experience in leadership positions, managing cybersecurity programs, and acting as a change agent to enhance application security program maturity.

• Proven experience in advancing application security program maturity.

• Expertise in Stakeholder Management and Leadership in Organizational Change Management.

• Familiarity with Secure Software Development Lifecycle (SSDLC).

• Candidates must reside within the EST or CST time zones.

• Must not require a C2C arrangement.

• Must not require sponsorship for a work visa.

• Preferred: Certification in code and dependency scanning.

• Preferred: Strong facilitation, writing, and communication skills with stakeholders.

• Preferred: Significant experience managing complex technology, cybersecurity, or application security programs across various teams.

• Preferred: Practical knowledge of software delivery and application security principles, including security requirements, code and dependency scanning, vulnerability management, remediation, and risk treatment.

• Preferred: Capability to translate technical and policy issues into clear actions, designated owners, decisions, and management reporting.

• Preferred: Experience in establishing repeatable processes, managing organizational change, utilizing metrics for performance enhancement, and prioritizing competing demands.

• Preferred: Experience in implementing, operationalizing, or governing SSDLC practices across multiple development teams.

🏝️ Benefits

• Contract duration through the end of June 2027, with a high likelihood of extension.

• Remote work available for applicants residing in the EST or CST time zones.

• Opportunities to engage in unique and challenging projects within application security.

• Collaboration with skilled colleagues and exposure to innovative problem-solving techniques.

• Equal Opportunity Employer.