Staff Application Security Engineer

TRIMEDX•Indianapolis, IN

5d•Remote

About The Position

Trimedx is seeking a Staff Application Security Engineer to own the application security program and its outcomes. The role sets the program strategy and roadmap, defines security architecture standards for web and cloud-native workloads, and builds scalable controls across 6–10 development teams without creating bottlenecks. The engineer embeds with development teams during architecture and design, leads threat modeling and security reviews, and designs and maintains an application security toolchain integrated into CI/CD pipelines. The role also manages exceptions and waivers, program metrics, risk tracking, and audit-ready evidence for ISO 27001 Annex A.8 controls and SOC 2 secure-development criteria. It serves as the primary connection among application teams, infrastructure security, IT leadership, and external penetration-testing vendors. The position requires independent program-level judgment, clear communication to technical and non-technical audiences, and support for safe AI adoption. Trimedx describes a collaborative culture focused on serving clients, patients, communities, and colleagues, and is an Equal Opportunity and Drug-Free Workplace. The role is marked remote.

Responsibilities

Own the application security program strategy and roadmap and define security architecture standards for web and cloud-native workloads.
Manage the exception and waiver process and report program health and metrics to IT leadership quarterly.
Work with development teams during architecture and design; lead threat modeling for new systems and significant features.
Build and maintain a security champions program and deliver developer security training suited to varying skill levels.
Design and own the AppSec toolchain, including SAST, SCA, secrets scanning, container image scanning, and DAST; integrate tools into CI/CD pipelines and manage findings triage and false-positive reduction.
Conduct or commission architecture security reviews for new platforms and major system changes.
Scope and coordinate external penetration testing and track remediation within SLA.
Maintain audit-ready evidence for ISO 27001 Annex A.8 controls, support SOC 2 secure-development criteria, own the AppSec risk register, and participate in audits as the subject matter expert.
Serve as the primary interface among application teams, infrastructure security, and IT leadership on application security matters.
Track emerging AI security trends and support safe AI adoption within InfoSec and across the company.
Evaluate tools and approaches, document architecture decisions, and recommend risk-based trade-offs for security debt against capacity constraints.
Communicate program health, findings, standards, risk summaries, and reports to leadership and development teams; build credibility and drive outcomes through relationships and technical influence.
Perform all other duties as assigned.