Responsibilities
Accountabilities- Own the AppSec program strategy and roadmap; define security architecture standards for web and cloud-native workloads (~30% of time).
- Manage the exception and waiver process; report program health and metrics to IT leadership quarterly.
- Embed with development teams at the architecture and design phase, not just code review; run threat modelling (STRIDE or equivalent) for new systems and significant features (~25% of time).
- Build and sustain a security champions program; deliver developer security training calibrated to skill level.
- Design and own the AppSec toolchain - SAST, SCA, secrets scanning, container image scanning, DAST; integrate tools into CI/CD pipelines; own findings triage and false-positive reduction (~20% of time).
- Conduct or commission architecture security reviews for new platforms and major system changes; scope and coordinate external penetration testing; track remediation within SLA (~15% of time).
- Maintain audit-ready evidence for ISO 27001 Annex A.8 controls; support SOC 2 secure-development criteria; own the AppSec risk register; participate in audits as the subject matter expert (~10% of time).
- Serve as the primary interface between application teams, infrastructure security, and IT leadership on AppSec matters.
- Track emerging AI security trends and support safe AI adoption within InfoSec and across the broader company.
Problem Solving and Analysis- Distinguishes between gatekeeping and enabling models; designs controls that scale across 6-10 development teams without becoming a bottleneck.
- Evaluates competing tools and approaches and produces defensible, documented architecture decisions without needing an existing playbook.
- Applies pattern recognition from prior program-build experience to problems with long-lived, organization-wide consequences.
- Prioritizes security debt against capacity constraints and recommends risk-based trade-offs.
Decision Making / Autonomy- Operates with a high degree of autonomy: arrives with a point of view, validates it against Trimedx's context in the first 30 days, and executes with confidence.
- Makes and documents security architecture decisions that stand up to scrutiny.
- Escalates highly complex, cross-functional, or resourcing issues to IT leadership; day-to-day program decisions are made independently.
- Owns the AppSec program and its outcomes; is not primarily a reviewer of individual pull requests or a responder to individual incidents.
Communications & Interactions- Reports program health, findings, and metrics to IT leadership on a recurring cadence.
- Leads threat modelling sessions and design reviews with development teams.
- Writes security standards, risk summaries, and program reports that are clear to a non-technical VP audience.
- Builds credibility and drives security outcomes through relationship and technical influence rather than authority.
- Serves as the organizational voice for secure development practices with leadership, development teams, and external pen-testing vendors.
- undefined
- All other duties as assigned.
#LI-RemoteTrimedx may also provide associates with benefits that include health/dental/vision, HSA/FSA, matching retirement plans, paid vacation and parental leave, adoption/infertility assistance, and more!
