Staff Application Security Engineer - Blue Team — San Francisco

We’re building a world of health around every individual — shaping a more connected, convenient and compassionate health experience. At CVS Health®, you’ll be surrounded by passionate colleagues who care deeply, innovate with purpose, hold ourselves accountable and prioritize safety and quality in everything we do. Join us and be part of something bigger – helping to simplify health care one person, one family and one community at a time. Staff Application Security Engineer – Blue Team Who Are You • A senior defensive security practitioner with deep engineering expertise and the ability to design, develop, and influence security solutions across the enterprise. • Highly experienced in protecting applications, cloud platforms, data assets, and infrastructure through proactive detection, prevention, response, and resilience strategies. • Passionate about building secure and scalable systems while driving continuous security improvements through automation and innovation. • A recognized subject matter expert in application security, cloud security, data security, and network security from a Blue Team / defensive operations perspective. • Comfortable leading security initiatives in complex environments including cloud-native architectures, distributed systems, hybrid infrastructures, and legacy platforms. • Able to provide technical leadership during security incidents while remaining calm and effective in high-pressure situations. • Skilled at influencing engineering teams, mentoring peers, and driving organization-wide adoption of secure-by-design principles. Role Responsibilities: Development & Enforcement • Design, implement, and maintain defensive security controls across applications, cloud platforms, data systems, and network environments. • Develop and enforce enterprise-wide application and data security standards, policies, and best practices. • Embed security controls into SDLC processes, CI/CD pipelines, and deployment automation frameworks. • Lead security architecture reviews and ensure alignment with organizational security objectives. • Establish security governance frameworks that improve confidentiality, integrity, availability, and resiliency. Collaboration & Expertise • Partner with Engineering, Infrastructure, Architecture, and Business teams to embed secure-by-design practices across products and services. • Serve as a trusted advisor and technical leader for Application Security, Cloud Security, and Secure Development practices. • Influence technical decision-making and security strategy across multiple teams and business units. • Drive organization-wide security awareness and operational readiness initiatives. Analysis & Configuration • Monitor, detect, investigate, and respond to security events, vulnerabilities, threats, and incidents. • Lead vulnerability assessments, remediation planning, risk prioritization, and validation efforts across application and data platforms. • Design, evaluate, and optimize defensive controls across cloud-native, hybrid, and on-premises environments. • Conduct security assessments, threat modeling exercises, and architecture reviews to identify and mitigate risks. • Implement advanced security solutions across multi-cloud, colocation, and enterprise environments. Operational Support • Participate in a rotational on-call schedule, including off-hours, nights, weekends, and holidays, supporting a 24x7 operational environment. • Lead security incident response activities including investigation, containment, eradication, recovery, and post-incident reviews. • Develop, maintain, and continuously improve incident response, detection, escalation, and recovery playbooks. • Drive operational improvements that strengthen incident readiness and cyber resilience. Mentorship & Training • Mentor and coach engineers on secure coding practices, security engineering principles, and defensive operations. • Provide guidance to development and operational teams on security best practices and emerging threats. • Support training initiatives that improve security maturity across the organization. • Foster a culture of shared responsibility for security and operational excellence. Innovation and Research • Research emerging threats, vulnerabilities, attack techniques, and security technologies. • Evaluate and recommend new security tools, platforms, and defensive capabilities. • Automate security operations using code and Security-as-Code principles to improve efficiency and scalability. • Improve threat detection, monitoring, alerting, and response capabilities through innovation and continuous improvement. Strategic Planning • Contribute to long-term security strategy, architecture roadmaps, and technology planning initiatives. • Define and drive enterprise security objectives and key performance indicators. • Partner with leadership to prioritize security investments and risk reduction activities. • Develop standards and practices that improve cyber resilience, redundancy, business continuity, and recovery capabilities. Basic Qualifications • 7+ years of experience in security engineering, application security, cloud security, or defensive security operations. • 3+ years of experience securing modern cloud platforms including AWS, Azure, and GCP. • 3+ years of experience with Docker, Kubernetes, Infrastructure-as-Code, and Security-as-Code methodologies. • 3+ years of experience in one or more programming or scripting languages such as Python, Java, C#, JavaScript, Shell, or PowerShell. • 3+ years of experience in networking, identity management, authentication, authorization, and threat mitigation techniques. Preferred Qualifications • Experience designing and operating defensive security controls within cloud-native, containerized, and distributed application environments. • Experience implementing data protection controls and supporting regulatory and compliance requirements including GDPR, CCPA, or similar frameworks. • Demonstrated experience designing and implementing enterprise-scale security controls and security automation solutions. • Deep understanding of networking, software-defined networking (SDN), zero-trust architectures, and cloud security models. • Experience performing threat modeling, security architecture reviews, and secure design assessments. • Ability to develop and interpret network, sequence, application architecture, and data flow diagrams. • Experience with compliance and security frameworks such as NIST, PCI DSS, HIPAA, HITRUST, ISO 27001, SOC 2, or CSA. • Experience securing enterprise data platforms, analytics environments, and data warehouses including Snowflake and similar technologies. • Experience defining and implementing cyber resilience, business continuity, backup, redundancy, and recovery strategies. • Relevant industry certifications such as CISSP, CCSP, GSEC, GIAC, AWS Security Specialty, Azure Security Engineer Associate, or equivalent. Education • Bachelor’s degree from an accredited college or university, or equivalent combination of education and relevant work experience (High School Diploma/GED plus 4 years of related experience) Pay Range The typical pay range for this role is: $130,295.00 - $260,590.00 This pay range represents the base hourly rate or base annual full-time salary for all positions in the job grade within which this position falls.  The actual base salary offer will depend on a variety of factors including experience, education, geography and other relevant factors.  This position is eligible for a CVS Health bonus, commission or short-term incentive program in addition to the base pay range listed above.  This position also includes an award target in the company’s equity award program.    Our people fuel our future. Our teams reflect the customers, patients, members and communities we serve and we are committed to fostering a workplace where every colleague feels valued and that they belong. Great benefits for great people We take pride in offering a comprehensive and competitive mix of pay and benefits that reflects our commitment to our colleagues and their families. This full‑time position is eligible for a comprehensive benefits package designed to support the physical, emotional, and financial well‑being of colleagues and their families. The benefits for this position include medical, dental, and vision coverage, paid time off, retirement savings options, wellness programs, and other resources, based on eligibility. Additional details about available benefits are provided during the application process and on Benefits Moments . We anticipate the application window for this opening will close on: 09/22/2026 Qualified applicants with arrest or conviction records will be considered for employment in accordance with all federal, state and local laws.