Application Security Program Manager

Knowledge Services

. Support the Information Security Office in transitioning the State’s SSDLC from a modernization project to a sustained operating program .

Posted 10/26/2026contractRemote • Maine • United StatesSeniorLeadWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in cybersecurity program management and leadership, with a focus on improving application security program maturity and operationalizing Secure Software Development Lifecycle (SSDLC) practices. Capable of managing stakeholder relationships, facilitating organizational change, and implementing repeatable processes to enhance performance across technology teams.

Highest-signal resume keywords

Cybersecurity Program ManagementSecure Software Development Lifecycle (SSDLC)Stakeholder ManagementOrganizational Change Management LeadershipApplication Security Program Maturity

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Application SecurityVulnerability ManagementRisk TreatmentCode ScanningDependency ScanningRemediationSecurity RequirementsPerformance MeasuresProcess ImprovementTechnical Reporting

Soft Skills

FacilitationStakeholder CommunicationOrganizational Change LeadershipWriting SkillsFeedback Gathering

Tools & Technologies

Security ToolingGitHub GovernanceApplication Development PlatformsInfrastructure Management

Certifications & Qualifications

Certification in Code and Dependency Scanning

Industry Keywords

Application SecurityCybersecuritySoftware DeliveryRisk ReductionContinuous Improvement

Tech Stack

Tools & technologies

Cyber Security

About the role

Key responsibilities & impact

Support the Information Security Office in transitioning the State’s SSDLC from a modernization project to a sustained operating program
Coordinate the people, decisions, workflows, and measures needed to operationalize application security practices across State technology teams
Drive adoption, performance, risk reduction, continuous improvement, follow-through, and accountability across stakeholders
Work with Vulnerability Management, Security Architecture, GRC, Application Development, GitHub Governance, infrastructure and platform teams, agency product owners, and vendors
Coordinate transition from project deliverables to owned processes with named owners, documented handoffs, decision paths, service expectations, and an operating cadence
Maintain the program roadmap, priorities, dependencies, risks, and improvement backlog
Validate and improve application risk, security requirements, design review, scanning, finding triage, remediation, exception, and release workflows
Plan rollout waves and support security champions, training, office hours, and developer-facing guidance
Gather feedback and remove workflow adoption barriers
Help teams create risk-ranked remediation plans with owners, target dates, and closure evidence
Track coverage gaps, aging findings, blockers, escalations, and remediation verification
Facilitate working groups and leadership reviews; maintain the responsibility model and route decisions to authorized owners
Define measures and coordinate reporting on application coverage, adoption, remediation, exceptions, and control performance
Coordinate related initiatives in repository governance, security tooling, platform integration, third-party application security, and developer enablement
Surface capacity, funding, and service dependencies; prepare options and recommendations for leadership

Requirements

What you’ll need

8 to 10 years of experience in leadership roles, cybersecurity program management, and change agent roles improving application security program maturity
Experience improving application security program maturity
Stakeholder Management and Organizational Change Management Leadership
Secure Software Development Lifecycle (SSDLC)
Applicants must reside in the EST or CST time zones
Cannot require C2C
Cannot require sponsorship for a work visa
Preferred: Certification in code and dependency scanning
Preferred: Strong facilitation, writing, and stakeholder communication skills
Preferred: Substantial experience managing complex technology, cybersecurity, or application security programs across multiple teams
Preferred: Working knowledge of software delivery and application security concepts, including security requirements, code and dependency scanning, vulnerability management, remediation, and risk treatment
Preferred: Ability to translate technical and policy issues into clear actions, owners, decisions, and management reporting
Preferred: Experience establishing repeatable processes, coordinating organizational change, using measures to improve performance, and managing competing priorities
Preferred: Experience implementing, operationalizing, or governing SSDLC practices across multiple development teams

Benefits

Comp & perks

Contract through the end of June 2027, likely for extension
Remote work provided the applicant resides in the EST or CST time zones
Opportunities to tackle unique and complex projects in application security
Collaboration with talented peers and exposure to creative problem-solving approaches
Equal Opportunity Employer