Application Security Strategist

Labcorp•Durham, NC

7d•$160,000 - $170,000•Hybrid

About The Position

Labcorp is seeking an Application Security Strategist to join their team in a remote capacity. This role is crucial for strengthening the company's application security posture by enabling secure design and development practices. The Application Security Strategist will act as a trusted security advisor to application developers, architects, and leadership, utilizing deep technical expertise and a consultative approach to guide teams in building secure, scalable applications. This position supports the enterprise security strategy by embedding security standards, improving risk management practices, and advancing secure development capabilities. Applicants living within 35 miles of Burlington, NC or Durham, NC will follow a hybrid schedule with a minimum of three in-office days per week. The position is full-time, exempt (salaried), with standard business hours of Monday through Friday, 8:00 a.m. to 5:00 p.m. local time. Flexibility in work hours may occasionally be required. Permanent authorization to work in the United States without employer sponsorship is required.

Requirements

8 or more years of combined experience across application security and software development, with a focus on translating application-layer risks into secure design standards and actionable guidance.
5 or more years of experience applying secure coding principles (OWASP Top 10) and designing or securing web applications, APIs, and microservices architectures.
3 or more years of experience with enterprise security frameworks (NIST CSF, CIS Controls, ISO 27001), secure design patterns, and operating in a consultative cross-functional role.
3 or more years of experience with hands-on application or software development, or equivalent demonstrated experience with the ability to credibly engage developers on secure coding practices and design decisions.
2 or more years of experience securing cloud-native applications in AWS or Azure and working with authentication protocols such as OAuth 2.0, OIDC, and SAML.
Permanent authorization to work in the United States without employer sponsorship now or in the future.

Nice To Haves

3 or more years of experience defining secure development standards, reference architectures, or integrating security into the SDLC, including DevSecOps practices and CI/CD workflows.
2 or more years of experience working with API security frameworks and tooling, with the ability to guide teams on securing modern API-driven architectures.
2 or more years of experience applying threat modeling methodologies to identify design-level risks and guide mitigation strategies with engineering and architecture teams.
2 or more years of experience working with application security testing tools (SAST, DAST, SCA), including interpreting findings and helping teams prioritize and remediate effectively.
1 or more years of experience enabling the secure design of AI-enabled applications, including emerging risks and secure design patterns.
Experience supporting security testing or assessment teams.
Familiarity with identity and access management platforms such as Okta, Microsoft Entra ID, or SailPoint.
Broad familiarity with cloud platform security capabilities and their integration into enterprise environments.
Relevant certifications such as CSSLP, GWAPT, or CISSP.
Strong analytical and problem-solving skills with a pragmatic approach to security solutions.
Developer-focused mindset with an understanding of modern application development practices.
Ability to simplify complex technical concepts for diverse audiences.
Strong collaboration skills across engineering, security, and architecture teams.
Proven ability to deliver practical, scalable, and reusable solutions.
High level of professionalism, adaptability, and continuous learning mindset.
Strong communication skills with the ability to translate complex security concepts into practical guidance.

Responsibilities

Define and document secure development standards and patterns for modern application architectures (web, API, microservices), grounded in industry best practices (OWASP) and informed by broader frameworks (NIST, CIS Controls).
Develop reusable patterns for common application scenarios like secure APIs, service-to-service communication, and front-end/back-end architecture.
Develop reference implementations, code samples, and starter templates to demonstrate secure design patterns and accelerate adoption.
Translate complex security risks into clear, developer-focused guidance.
Contribute to the creation of machine-consumable security patterns for AI-enabled and automated development tools.
Collaborate with engineers and architects during design discussions to provide guidance on secure application architecture and design decisions.
Identify common security pitfalls early in the lifecycle.
Provide guidance on secure integration and data protection patterns (e.g., input validation, output encoding, API security, session management, secrets management).
Promote secure-by-design and secure-by-default principles.
Support the integration of authentication and authorization patterns within application architecture.
Coach development teams on secure implementation of protocols like OAuth 2.0, OIDC, and SAML.
Guide alignment of application security practices with identity and access management, identity governance, and privileged access management solutions.
Partner with Digital Identity Services, Cybersecurity Engineering, Product Security Testing, and other teams to provide application security guidance and support risk mitigation.
Collaborate with the Governance, Risk, and Compliance team to align application security practices with enterprise policies and regulatory requirements.
Work with Cybersecurity Operations to enhance detection and response capabilities for application-level threats.
Engage with Enterprise Architecture teams to influence secure design decisions.
Support data protection initiatives by advising teams on appropriate controls for sensitive data handling and exposure mitigation.
Review vulnerability patterns and provide guidance on prioritization and remediation of application security risks.
Serve as a trusted advisor to engineering and architecture teams, offering practical and actionable security recommendations.
Lead the standardization of application security risk management practices across teams.
Stay current with emerging threats, vulnerabilities, and trends in application security.
Evaluate and evolve security standards to support cloud native, API first, distributed, and AI enabled applications.
Contribute to the development of scalable, consistent application security enablement practices across the organization.