Application Security Program Manager (remote)

Knowledge Services • ,

11d • Remote

About The Position

Knowledge Services is seeking an Application Security Program Manager to support the State of Maine Office of Technology through the end of June 2027, with a likely extension. The position is remote for applicants residing in the Eastern or Central time zones. The manager supports the Information Security Office in transitioning the State’s secure software development lifecycle (SSDLC) modernization project into a sustained operating program. The role coordinates the people, decisions, workflows, and measures needed to make application security practices workable across State technology teams, then focuses on adoption, performance, risk reduction, and continuous improvement across the application security portfolio.

This cross-functional program management role works with Vulnerability Management, Security Architecture, Governance Risk and Compliance (GRC), Application Development, GitHub Governance, infrastructure and platform teams, agency product owners, and vendors. The manager drives follow-through, adoption, and accountability across stakeholders, and routes decisions to appropriate owners while specialist teams retain their technical, product, and risk approval authority. The role oversees application security efforts across multiple teams and drives improvements to strengthen the State of Maine’s security posture.

The position coordinates transition from project deliverables to owned processes; maintains the roadmap, priorities, dependencies, risks, and improvement backlog; and works with accountable teams to improve application risk, security requirements, design review, scanning, finding triage, remediation, exception, and release workflows. It supports rollout, security champions, training, office hours, developer guidance, and feedback gathering. The manager helps product and development teams create risk-ranked remediation plans and tracks coverage gaps, aging findings, blockers, and escalations. The role also facilitates working groups and leadership reviews, coordinates reporting and measures, and supports related initiatives in repository governance, security tooling, platform integration, third-party application security, and developer enablement. The position is remote, provided the employee resides in the EST or CST time zones. Candidates requiring C2C or work visa sponsorship cannot be accepted.

Requirements

• 8 to 10 years of experience in leadership roles, cybersecurity program management, and change agent roles improving application security program maturity.
• Experience improving application security program maturity.
• Stakeholder management and organizational change management leadership experience.
• Experience with the Secure Software Development Lifecycle (SSDLC).
• Applicants must reside in the EST or CST time zones to work remotely.
• Candidates requiring C2C or work visa sponsorship cannot be accepted.

Nice To Haves

• Certification in code and dependency scanning.
• Strong facilitation, writing, and stakeholder communication skills.
• Substantial experience managing complex technology, cybersecurity, or application security programs across multiple teams, with demonstrated delivery through influence and shared accountability.
• Working knowledge of software delivery and application security concepts, including security requirements, code and dependency scanning, vulnerability management, remediation, and risk treatment.
• Ability to translate technical and policy issues into clear actions, owners, decisions, and management reporting.
• Experience establishing repeatable processes, coordinating organizational change, using measures to improve performance, and managing competing priorities in an evolving program.
• Experience implementing, operationalizing, or governing SSDLC practices across multiple development teams.

Responsibilities

• Coordinate transition from project deliverables to owned processes, including named owners, documented handoffs, decision paths, service expectations, and an operating cadence.
• Maintain the application security program roadmap, priorities, dependencies, risks, and improvement backlog.
• Work with accountable teams to validate and improve application risk profiles and security requirements, design review, scanning, finding triage, remediation, exception, and release workflows.
• Ensure guidance reflects actual tools and the needs of different applications and vendor models.
• Plan rollout waves with development and platform partners; support security champions, training, office hours, and developer-facing guidance.
• Gather feedback and remove barriers that prevent teams from applying workflows consistently.
• Help product and development teams turn findings into risk-ranked plans with owners, target dates, and closure evidence.
• Track coverage gaps, aging findings, blockers, and escalations while responsible teams perform remediation and verification.
• Facilitate working groups and leadership reviews, maintain an accurate responsibility model, and route design questions to Security Architecture and policy, exception, and risk decisions through GRC and authorized Information Security Office leadership.
• Define useful measures with data owners and coordinate trustworthy reporting on application coverage, adoption, remediation, exceptions, and control performance.
• Use trends and team feedback to propose changes, report progress, and adjust priorities.
• Coordinate initiatives in repository governance, security tooling, platform integration, third-party application security, and developer enablement.
• Surface capacity, funding, and service dependencies and prepare concise options and recommendations for leadership.
• Drive follow-through, program adoption, and stakeholder accountability, escalating decisions to appropriate owners.

Benefits

• Collaboration with talented peers and exposure to creative problem-solving approaches.
• Opportunities to tackle unique and complex projects in application security.
• Opportunity to contribute to protecting citizens' data and securing essential government services.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed