Application Security Principal

Who we are

Founded in 1999 and headquartered in Central Ohio were a privately-owned independent healthcare navigation organization. We believe that no one should have to navigate the cost and complexity of healthcare alone and were on a mission to make healthcare simpler and more effective for our millions of members. Our big-hearted tech-savvy team fights to ensure that our members get the care they need when they need it at the most affordable cost thats why we call ourselves Healthcare Warriors.

Were committed to building diverse and inclusive teams more than 2000 of us and counting so if youre excited about this position we encourage you to apply even if your experience doesnt match every requirement.

About the role

The Application Security Principal is a senior hands-on security leader who reports directly to the Chief Information Security Officer (CISO) and is responsible for building operating and continuously improving the enterprise Application Security (AppSec) program. The role is deeply embedded within software engineering initiatives working side-by-side with development teams to enable secure-by-design and secure-by-default software delivery. This leader focuses on teaching mentoring and influencing engineers to write secure code and to effectively use modern AppSec tools and automation to reduce risk while maintaining delivery velocity. The role operates in a regulated healthcare environment and ensures alignment with HIPAA and HITRUST requirements.
Location: This position is located at our Dublin OH campus or may work remotely anywhere in the United States of America.

What youll do (Essential Responsibilities)

• Create own and drive the enterprise Application Security program including vision strategy roadmap and operating model.
• Embed within software engineering projects to provide hands-on guidance for secure design coding testing and deployment practices.
• Teach mentor and lead software engineers to improve secure coding skills and security decision-making throughout the SDLC.
• Define and operationalize a secure SDLC including threat modeling secure design reviews automated security testing and release controls.
• Own and optimize application security tooling and workflows including Snyk SonarCloud GitHub Advanced Security GitHub Copilot Palisade and related CI/CD integrations.
• Establish developer-friendly remediation workflows including prioritized findings fix guidance and automation where possible.
• Partner with Engineering and Product leadership to align application security priorities with business objectives and delivery timelines.
• Lead threat modeling and architectural risk assessments for new applications APIs and major enhancements.
• Develop and track AppSec metrics and KPIs that demonstrate risk reduction coverage and program effectiveness.
• Ensure application security controls and practices meet HIPAA Security Rule and HITRUST CSF requirements and support audit readiness.
• Collaborate with infrastructure cloud and enterprise security teams on identity secrets management and secure platform patterns.
• Support security incident response activities related to application vulnerabilities and contribute to root-cause analysis and long-term remediation.
• Build and lead an application security champions or guild program to scale secure development practices across teams.
• All other duties as assigned.

What youll bring (Qualifications)

• Experience: Extensive experience designing and leading application security programs within complex enterprise environments.
• Strong background in software engineering with the ability to read review and reason about code for security issues.
• Hands-on experience integrating and operating modern AppSec tools such as Snyk SonarCloud GitHub Advanced Security and CI/CD pipelines.
• Experience guiding developers in the effective and responsible use of AI-assisted development tools such as GitHub Copilot.
• Deep understanding of secure SDLC principles threat modeling methodologies and common application vulnerability classes.
• Experience securing cloud-native API-driven and microservices-based architectures.
• Strong knowledge of healthcare regulatory requirements including HIPAA and HITRUST and their application to software development.
• Proven ability to influence without authority and to build strong partnerships with engineering and product teams.
• Excellent communication and teaching skills with the ability to translate security concepts into practical developer guidance.
• Demonstrated leadership program management and strategic planning capabilities.
• A high degree of personal accountability and trustworthiness a commitment to working within Quantum Healths policies values and ethics and protecting the sensitive data entrusted to us.

--

#LI-AK1 #LI-Hybrid #LI-Remote