Distinguished Engineer, Application Security

CVS Health

Confirmed live yesterday High trust

Remote

Quick summary

Work type: Remote
Location: Arizona
Salary: $175,100–$334,750 / yr
Employment: Full-time
Posted: 34 days ago
Freshness: Confirmed live yesterday
Closes: Nov 30, 2026
Nearby: 80 roles within 25 mi

Market check

Salary context

Above market

How this pay compares to similar roles

Similar $188k

This role $255k

$120k $358k

below market most similar roles pay here above market

This role pays more than 88% of similar roles. Most pay $149,375–$226,660 — the blue band above. At the midpoint, this role pays about $255k versus about $188k for comparable roles.

Based on 240 similar postings.

Employer

About CVS Health

CVS Health is a leading American healthcare company operating retail pharmacies, pharmacy benefit management services, and a health insurance segment through Aetna, one of the nation''s largest health insurers. Industry: Healthcare & Pharmacy

CVS Health currently has 119 open roles on FindRole.

Listed pay typically runs $106,605–$260,590 across 115 roles with salary data.

Most-posted roles

View all roles at CVS Health

At a glance

TL;DR · Distinguished Engineer, Application Security

Role Posting Log in to save

JOB TITLE: Distinguished Engineer - Application Security The Distinguished Engineer - Application Security serves as a senior technical leader and strategist for the Application Security team. This role drives enterprise strategy to secure software across web, mobile, API, microservice, and AI-native applications in cloud, on-prem, SaaS, and hybrid environments. You will build and oversee the technical architecture of the application security tooling stack, including SAST, DAST, SCA, IAST/RASP, secrets scanning, API security, IaC, and container scanning. You will integrate these into CI/CD pipelines and developer platforms to create secure-by-default paved paths. Key responsibilities include establishing guardrails for AI-assisted software development and managing software supply chain security using SBOMs and the SLSA framework. The role addresses complex healthcare-sector security requirements, including HIPAA, HITRUST CSF, and PCI DSS 4.0 compliance.

What does a Engineer earn in Remote?

Median $199471 from 30 postings across 16 companies.

See salary data

Skills

Application Security SAST DAST SCA IAST RASP ASPM ASOC CI/CD Python Java Go TypeScript JavaScript C# Kubernetes GitHub Actions GitLab CI Jenkins Argo API Security Threat Modeling SBOM SLSA eBPF WAF GraphQL gRPC REST OWASP ASVS NIST SSDF HIPAA PCI DSS HITRUST Service Mesh

What you'll do

Drive the enterprise application security strategy and architectural direction for web, mobile, API, and AI-native applications.
Integrate security controls into CI/CD pipelines as native platform capabilities rather than separate bolt-on tools.
Own the technical strategy and end-to-end architecture for the application security tooling stack, including SAST, DAST, and SCA.
Establish technical strategies and guardrails for the safe adoption of AI coding assistants and AI-generated code.
Lead the selection, evaluation, and integration of security tools into a coherent Application Security Posture Management (ASPM) view.
Provide hands-on support to application teams to ensure secure coding standards are the default path for development.
Design and deliver secure-by-default paved paths and outcome-based metrics to translate security posture into business risk.
Act as a technical bridge to influence security investment and execution across engineering and business organizational boundaries.

What we're looking for

15+ years of experience in technical roles with the ability to influence without authority across technical and executive audiences.
10+ years of experience acting as a bridge between deep technical work and business strategy.
10+ years of hands-on software engineering experience in multiple languages (Java, C#, JavaScript/TypeScript, Python, Go) with current coding proficiency.
8+ years in enterprise-scale application security roles including threat modeling, secure design review, secure code review, and vulnerability triage.
5+ years setting multi-year technical strategy and architectural roadmaps for enterprise-scale application security or DevSecOps programs.
Deep knowledge of the application security tooling landscape (SAST, DAST, SCA, IAST/RASP, secrets scanning, API security, container and IaC scanning, ASPM/ASOC).
Demonstrated experience integrating security controls into modern CI/CD pipelines and developer platforms as native, low-friction capabilities.
Bachelor's degree in Computer Science, Engineering, or a related field (or related experience).

Similar roles

Security Engineer, Application Security

Blue Cross Blue Shield Association (BCBSA)

Chicago +1 14 days ago $118,500–$171,825

Application Security DevSecOps SAST DAST SCA Threat Modeling Infrastructure as Code Python Java JavaScript TypeScript Node.js C# Go SQL Bash AWS Azure Kubernetes OpenShift Docker Terraform Bicep Helm GitHub Actions Jenkins Azure DevOps Burp Suite OWASP ZAP Checkmarx Veracode Fortify SonarQube Snyk Prisma Cloud Wiz Tenable Aqua Security Trivy Postman SoapUI HIPAA HITRUST NIST Cybersecurity Framework FedRAMP FISMA FIPS OWASP Top 10 OWASP API Security Top 10 OWASP ASVS

5+ yrs exp Hybrid

Save

Application Security Engineer

Booz Allen Hamilton

Annapolis Junction, MD +1 39 days ago $69,400–$158,000

SAST DAST SCA DevSecOps Secure SDLC Container Security Cloud Security Vulnerability Management OWASP SAMM BSIMM NIST SSDF NIST CSF ISO 27001 MITRE ATT&CK ISO/IEC 42001 IEC 62443

2+ yrs exp

Save

Senior Application Security Engineer

Arch Capital Group

Farmington, CT 14 days ago $127,000–$172,000

Application Security SAST DAST SCA CI/CD DevSecOps AWS Azure Containers Serverless Threat Modeling NIST OWASP MITRE SDLC Vulnerability Management

5+ yrs exp Hybrid

Save

Application Security Engineer

Booz Allen Hamilton

Washington, DC 14 days ago $62,000–$141,000

SAST DAST Threat Modeling Burp Suite Veracode Java Python .NET C# Linux UNIX OWASP NIST 800-53 FIPS FedRAMP IAST Eclipse JDeveloper

6+ yrs exp

Save

Distinguished Engineer, AI Security

CVS Health

Scottsdale, AZ 54 days ago $175,100–$334,750

AI Security Generative AI LLM Transformer-based NLP Agentic AI Zero Trust MITRE ATLAS NIST RMF ISO/IEC Privacy-Enhancing Technologies (PETs) Adversarial ML Cloud Security Hybrid Infrastructure Model Lifecycle Security Threat Modeling Vulnerability Management HIPAA GDPR NIST CSF

10+ yrs exp Hybrid

Save

Senior Application Security Engineer

Upstart

Remote (Canada) 53 days ago $166,900–$230,900

Application Security Threat Modeling Security Architecture Java Python Ruby Go SAST DAST SCA CI/CD Secrets Management API Security Microservices GraphQL REST GenAI AWS CISSP CSSLP CCSP

5+ yrs exp Remote

Save