Application Security Program Manager
Posted 7hrs ago
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Application security program manager transitioning Maine state government’s SSDLC modernization into sustained operations. Coordinating risk, remediation, governance, adoption, and reporting across technology teams.
Responsibilities:
- Support the Information Security Office in transitioning the State’s SSDLC from a modernization project to a sustained operating program
- Coordinate the people, decisions, workflows, and measures needed to operationalize application security practices across State technology teams
- Drive adoption, performance, risk reduction, continuous improvement, follow-through, and accountability across stakeholders
- Work with Vulnerability Management, Security Architecture, GRC, Application Development, GitHub Governance, infrastructure and platform teams, agency product owners, and vendors
- Coordinate transition from project deliverables to owned processes with named owners, documented handoffs, decision paths, service expectations, and an operating cadence
- Maintain the program roadmap, priorities, dependencies, risks, and improvement backlog
- Validate and improve application risk, security requirements, design review, scanning, finding triage, remediation, exception, and release workflows
- Plan rollout waves and support security champions, training, office hours, and developer-facing guidance
- Gather feedback and remove workflow adoption barriers
- Help teams create risk-ranked remediation plans with owners, target dates, and closure evidence
- Track coverage gaps, aging findings, blockers, escalations, and remediation verification
- Facilitate working groups and leadership reviews; maintain the responsibility model and route decisions to authorized owners
- Define measures and coordinate reporting on application coverage, adoption, remediation, exceptions, and control performance
- Coordinate related initiatives in repository governance, security tooling, platform integration, third-party application security, and developer enablement
- Surface capacity, funding, and service dependencies; prepare options and recommendations for leadership
Requirements:
- 8 to 10 years of experience in leadership roles, cybersecurity program management, and change agent roles improving application security program maturity
- Experience improving application security program maturity
- Stakeholder Management and Organizational Change Management Leadership
- Secure Software Development Lifecycle (SSDLC)
- Applicants must reside in the EST or CST time zones
- Cannot require C2C
- Cannot require sponsorship for a work visa
- Preferred: Certification in code and dependency scanning
- Preferred: Strong facilitation, writing, and stakeholder communication skills
- Preferred: Substantial experience managing complex technology, cybersecurity, or application security programs across multiple teams
- Preferred: Working knowledge of software delivery and application security concepts, including security requirements, code and dependency scanning, vulnerability management, remediation, and risk treatment
- Preferred: Ability to translate technical and policy issues into clear actions, owners, decisions, and management reporting
- Preferred: Experience establishing repeatable processes, coordinating organizational change, using measures to improve performance, and managing competing priorities
- Preferred: Experience implementing, operationalizing, or governing SSDLC practices across multiple development teams
Benefits:
- Contract through the end of June 2027, likely for extension
- Remote work provided the applicant resides in the EST or CST time zones
- Opportunities to tackle unique and complex projects in application security
- Collaboration with talented peers and exposure to creative problem-solving approaches
- Equal Opportunity Employer

















