> Markdown version of [/jobs/ext/3062751-manager-application-security](https://www.wearedevelopers.com/jobs/ext/3062751-manager-application-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Manager, Application Security - **Company:** Citizens Financial Group - **Location:** Olympia, WA, United States - **Experience:** Expert - **Salary:** $133,000.0 - $190,000.0 - **Contract:** Permanent contract - **Skills:** Testing (Software), Application Programming Interfaces (APIs), Applications Architecture, Application Integration Architecture, Software System Penetration Testing, User Authentication, Cloud Computing, Cloud Computing Security, Cloud Engineering, Cyber Security, Information Systems, Continuous Delivery, Continuous Integration, Software Design Patterns, DevOps, Web Development, Internet Security, Open Web Application Security, Systems Development Life Cycle, Secure Coding, Information Technology Security Auditing, Software Engineering, Software Vulnerability Management, Enterprise Software Applications, Software Security, Information Technology, Devsecops, Static Application Security Testing, Microservices, Dynamic Application Security Testing - **Published:** September 25, 2026 - **Apply:** https://www.careerbuilder.com/job-details/manager-application-security-olympia-wa--35597786-1297-4d08-bd6c-08d8caef7c1d ## About the Role * 10 plus years of cybersecurity experience with a strong focus on application security * 5 plus years of people or program leadership experience operating an application security program in an enterprise environment * Deep understanding of application security risks, including OWASP Top 10 * Hands on experience with modern SDLC, CI CD, and DevSecOps practices * Experience implementing and managing application security testing tools and processes * Ability to assess application architecture, design patterns, and authentication and authorization models * Strong experience partnering with engineering teams to drive secure by design outcomes * Excellent written and verbal communication skills, including executive level reporting * Proven ability to influence engineering, product, risk, and compliance stakeholders Preferred Experience * Experience in highly regulated industries such as financial services or healthcare * Familiarity with cloud native and microservices based architectures * Experience with API security platforms and runtime visibility tools * Background in penetration testing or threat modeling * Experience defining application security metrics, KPIs, and maturity models Education and Certifications * Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related field * Preferred certifications include CISSP, CISM, CISA, GPEN, or equivalent, Application Integration, Application Programming Interface (API), Applications Security, Architectural Analysis, Architectural Design, Authentication, Automation, Cloud Computing, Communication Skills, Computer Science, Computer Security, Continuous Deployment/Delivery, Continuous Improvement, Continuous Integration, Design Patterns Programming Methodologies, Enterprise Protection, Equal Employment Opportunity (EEO), Finance, Financial Services, Genetics, Healthcare, Hubs, Information Technology & Information Systems, Internet Security, Leadership, Machine Tool, Medical Conditions, Mentoring, Metrics, Microservices, Military, Mobile Web Programming, Penetration Testing, Presentation/Verbal Skills, Quality Assurance Methodology, Regulations, Risk, Risk Analysis, Risk Management, Security Analysis, Security Auditing, Security Infrastructure, Security Monitoring, Software Design, Software Development, Software Engineering, Software Testing, State Laws and Regulations, Test Tools, Threat Modeling, Writing Skills ## Description The Manager, Application Security is responsible for leading, scaling, and maturing enterprise application security capabilities across a complex technology environment. This role owns the application security program end to end, ensuring secure software development practices are embedded into the SDLC while balancing regulatory, risk, and business requirements. As part of the cybersecurity organization, this role partners closely with engineering, platform, cloud, DevOps, and risk teams to drive measurable risk reduction without slowing delivery. Key Responsibilities * Lead the enterprise application security program across web and mobile platforms * Define and execute the application security vision, strategy, and roadmap aligned to business and risk objectives * Establish and enforce application security standards, secure coding practices, and control requirements * Partner with engineering leadership to embed security into architecture, design, and delivery decisions * Oversee integration of application security testing tools, including SAST, DAST, and SCA, into CI CD pipelines * Lead application security assessments and risk based remediation planning * Provide threat informed guidance to engineering teams on high risk vulnerabilities and design patterns * Collaborate with vulnerability management, cloud security, and infrastructure teams to drive cohesive risk reduction * Establish governance, metrics, and reporting to measure application security maturity and effectiveness * Represent application security in audit, regulatory, and risk management engagements * Translate technical security risks into clear, business relevant insights for senior leaders * Build, mentor, and develop application security engineers and subject matter experts * Continuously improve tooling, automation, and processes to scale AppSec capabilities efficiently ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [DevSecOps: Injecting Security into Mobile CI/CD Pipelines](https://www.wearedevelopers.com/videos/273-devsecops-injecting-security-into-mobile-ci-cd-pipelines) - [From DevOps to Scaled DevOps: How We’re Rebuilding Continuous Delivery as a Platform](https://www.wearedevelopers.com/videos/100018-from-devops-to-scaled-devops-how-we-re-rebuilding-continuous-delivery-as-a-platform) - [Microservices: how to get started with Spring Boot and Kubernetes](https://www.wearedevelopers.com/videos/242-microservices-how-to-get-started-with-spring-boot-and-kubernetes) - [DevSecOps culture](https://www.wearedevelopers.com/videos/783-devsecops-culture) - [DevSecOps: Security in DevOps](https://www.wearedevelopers.com/videos/36-devsecops-security-in-devops) ## Related Articles - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [The 8 Best Code Testing Tools](https://www.wearedevelopers.com/magazine/402-the-8-best-code-testing-tools) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)