The Application Security Program Manager (Business SME 1) supports the Information Security Office in transitioning the State's secure software development lifecycle (SSDLC) from a near-complete modernization project to a sustained operating program. The position coordinates the people, decisions, workflows, and measures needed to make application security practices workable across State technology teams. As initial transition tasks are completed, the manager shifts effort to adoption, performance, risk reduction, and continuous improvement across the broader application security portfolio.
Coordinate transition from project deliverables to owned processes, including named owners, documented handoffs, decision paths, service expectations, and a practical operating cadence. Maintain the program roadmap, priorities, dependencies, risks, and improvement backlog.
Work with accountable teams to validate and improve the application risk profile, security requirements, design review, scanning, finding triage, remediation, exception, and release workflows. Ensure guidance reflects real tools and different applications and vendor models.
Plan rollout waves with development and platform partners; support security champions, training, office hours, and clear developer-facing guidance. Gather feedback and remove barriers that prevent teams from applying the workflow consistently.
Help product and development teams turn findings into risk-ranked plans with owners, target dates, and closure evidence. Track coverage gaps, aging findings, blockers, and escalations while the responsible teams perform remediation and verification.
Facilitate working groups and leadership reviews, maintain an accurate responsibility model, and route design questions to Security Architecture and policy, exception, and risk decisions through GRC and authorized Information Security Office leadership.
Define useful measures with data owners; coordinate trustworthy reporting on application coverage, adoption, remediation, exceptions, and control performance. Use trends and team feedback to propose changes, report progress, and adjust priorities.
Coordinate related initiatives in repository governance, security tooling, platform integration, third-party application security, and developer enablement. Surface capacity, funding, and service dependencies; prepare concise options and recommendations for leadership.
Substantial experience managing complex technology, cybersecurity, or application security programs across multiple teams, with demonstrated delivery through influence and shared accountability.
Working knowledge of software delivery and application security concepts, including security requirements, code and dependency scanning, vulnerability management, remediation, and risk treatment.
Ability to translate technical and policy issues into clear actions, owners, decisions, and management reporting; strong facilitation, writing, and stakeholder communication skills.
Experience establishing repeatable processes, coordinating organizational change, using measures to improve performance, and managing competing priorities in an evolving program.
Experience implementing, operationalizing, or governing Secure Software Development Lifecycle (SSDLC) practices across multiple development teams.
Information Security,Security Architecture,GitHub,secure software development,Application Development,application security,Vulnerability Management,platform integration,Coordinate,coordinating,creative problem-solving,leadership,self-motivated individual,Collaboration,trustworthy,continuous improvement,organizational change,confidentiality,design review,Governance,Governance Risk and Compliance (GRC),GRC,infrastructure,management reporting,program management,risk,risks,risk profile,risk reduction,risk treatment,security tooling,security requirements,stakeholder communication,triage,workflows
Equal Opportunity Employer: Race, Color, Religion, Sex, Sexual Orientation, Gender Identity, National Origin, Age, Genetic Information, Disability, Protected Veteran Status, or any other legally protected group status.
At Randstad Digital, we welcome people of all abilities and want to ensure that our hiring and interview process meets the needs of all applicants. If you require a reasonable accommodation to make your application or interview experience a great one, please contact
Pay offered to a successful candidate will be based on several factors including the candidate's education, work experience, work location, specific job duties, certifications, etc. In addition, Randstad Digital offers a comprehensive benefits package, including: medical, prescription, dental, vision, AD&D, and life insurance offerings, short-term disability, and a 401K plan (all benefits are based on eligibility).
This posting is open for thirty (30) days.
It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.
