Application Security Program Manager
Location: Remote, U.S. | Eastern or Central Time Zones
Work Arrangement: 100% remote for most candidates; candidates residing in Maine may have periodic onsite requirements
Experience: 8–10 years in leadership, cybersecurity program management, and organizational change
Compensation: $66-68 per hour with benefits
Contract: W2, 1 year ongoing
Overview
Epitec is seeking an experienced Application Security Program Manager to help transition a modernized Secure Software Development Lifecycle (SSDLC) into a sustainable, enterprise-wide operating program.
This is a highly cross-functional leadership role focused on application security maturity, stakeholder management, organizational change, risk reduction, and continuous improvement. The ideal candidate combines strong cybersecurity program leadership with working knowledge of application security and modern software development practices.
What You’ll Do
- Lead the transition of SSDLC initiatives from project deliverables into sustainable, repeatable operating processes.
- Maintain program roadmaps, priorities, dependencies, risks, ownership models, and continuous-improvement backlogs.
- Partner with Vulnerability Management, Security Architecture, GRC, Application Development, platform teams, product owners, and vendors.
- Improve application security workflows covering security requirements, design reviews, scanning, vulnerability triage, remediation, exceptions, and release processes.
- Plan adoption and rollout initiatives across development and platform teams.
- Support security champions, training, office hours, and developer-facing security guidance.
- Help development and product teams translate security findings into risk-ranked remediation plans with clear owners and target dates.
- Track application coverage, aging findings, remediation progress, blockers, exceptions, and escalations.
- Facilitate cross-functional working groups and leadership reviews.
- Develop meaningful program measures and coordinate reporting on adoption, remediation, application coverage, exceptions, and control performance.
- Coordinate related initiatives involving repository governance, security tooling, platform integrations, third-party application security, and developer enablement.
- Identify resource, capacity, service, and funding dependencies and develop clear recommendations for leadership.
Required Qualifications
- 8–10 years of experience in leadership, cybersecurity program management, and/or organizational change roles.
- Demonstrated experience improving application security program maturity.
- Strong experience with Secure Software Development Lifecycle (SSDLC) practices.
- Proven ability to manage complex, cross-functional technology or cybersecurity programs.
- Strong stakeholder management and organizational change leadership skills.
- Working knowledge of application security concepts, including:
- Security requirements
- Code and dependency scanning
- Vulnerability management
- Finding triage and remediation
- Risk treatment and exception processes
- Ability to turn technical, security, and policy issues into clear decisions, actions, owners, and executive-level reporting.
- Excellent facilitation, written communication, and stakeholder communication skills.
- Experience establishing repeatable processes, measuring program performance, and managing competing priorities.
Preferred Experience
- Implementing, operationalizing, or governing SSDLC practices across multiple development teams.
- Application security governance in a large, complex technology environment.
- Coordinating security initiatives across technical teams that maintain separate decision-making and approval responsibilities.
- Using metrics, stakeholder feedback, and risk trends to continuously improve application security programs.
Work Location
The position is 100% remote for candidates located in the Eastern or Central time zones, with an exception for candidates residing in Maine. Maine-based candidates may be required to work onsite one day every two weeks, and related travel expenses are not reimbursed.
Additional Requirements
The selected candidate must successfully complete required pre-employment background checks and meet applicable credentials and onboarding requirements.
#LI-PS1 #INDPRO