Business SME

Novalink Solutions LLC • Augusta, ME

1d

About The Position

The Application Security Program Manager (Business SME 1) supports the Information Security Office in transitioning the State’s secure software development lifecycle (SSDLC) from a near-complete modernization project to a sustained operating program. The role coordinates the people, decisions, workflows, and measures needed to make application security practices workable across State technology teams. As transition tasks are completed, the manager focuses on adoption, performance, risk reduction, and continuous improvement across the broader application security portfolio.

This cross-functional program management role works with Vulnerability Management, Security Architecture, Governance Risk and Compliance (GRC), Application Development, GitHub Governance, infrastructure and platform teams, agency product owners, and vendors. The manager drives follow-through, program adoption, and accountability across stakeholders and elevates decisions to the appropriate owner. Specialist teams retain their established technical, product, and risk approval authority.

Requirements

• 8 to 10 years of experience in leadership roles, program management, and change-agent roles improving application security program maturity.
• Experience in application security leadership.
• Experience in leadership roles and cybersecurity program management.
• Experience improving application security program maturity.
• Stakeholder management and organizational change management leadership.
• The selected candidate must pass required background checks as a condition of employment.

Nice To Haves

• Substantial experience managing complex technology, cybersecurity, or application security programs across multiple teams, with demonstrated delivery through influence and shared accountability.
• Working knowledge of software delivery and application security concepts, including security requirements, code and dependency scanning, vulnerability management, remediation, and risk treatment.
• Ability to translate technical and policy issues into clear actions, owners, decisions, and management reporting; strong facilitation, writing, and stakeholder communication skills.
• Experience establishing repeatable processes, coordinating organizational change, using measures to improve performance, and managing competing priorities in an evolving program.
• Experience implementing, operationalizing, or governing Secure Software Development Lifecycle (SSDLC) practices across multiple development teams.

Responsibilities

• Coordinate the transition from project deliverables to owned processes, including named owners, documented handoffs, decision paths, service expectations, and an operating cadence; maintain the program roadmap, priorities, dependencies, risks, and improvement backlog.
• Work with accountable teams to validate and improve application risk profiles and workflows for security requirements, design reviews, scanning, finding triage, remediation, exceptions, and releases.
• Plan rollout waves with development and platform partners; support security champions, training, office hours, and developer-facing guidance; gather feedback and remove barriers to consistent workflow adoption.
• Help product and development teams turn findings into risk-ranked plans with owners, target dates, and closure evidence; track coverage gaps, aging findings, blockers, and escalations while responsible teams perform remediation and verification.
• Facilitate working groups and leadership reviews, maintain an accurate responsibility model, and route design questions to Security Architecture and policy, exception, and risk decisions through GRC and authorized Information Security Office leadership.
• Define useful measures with data owners and coordinate reporting on application coverage, adoption, remediation, exceptions, and control performance; use trends and feedback to propose changes, report progress, and adjust priorities.
• Coordinate related initiatives in repository governance, security tooling, platform integration, third-party application security, and developer enablement; surface capacity, funding, and service dependencies and prepare options and recommendations for leadership.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed