{"id":3001574,"url":"https://alion.io/job/highmark-health-senior-security-engineer-secure-sdlc","title":"Senior Security Engineer - Secure SDLC","company":{"id":20346,"name":"Highmark Health","domain":"highmarkhealth.org","url":"https://alion.io/company/highmark-health","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States","Washington, United States","United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":164600,"max":null,"currency":"USD","period":"year","gross":null,"usd_annual":164600},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agentic Workflows","optional":false},{"name":"AI Agents","optional":false},{"name":"CI/CD","optional":false},{"name":"EPSS","optional":false},{"name":"KEV","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP SAMM","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Shift-Left Security","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Claude Code","optional":true},{"name":"Copilot","optional":true},{"name":"Cursor","optional":true},{"name":"DLP","optional":true},{"name":"Docker","optional":true},{"name":"GitHub Actions","optional":true},{"name":"GitLab","optional":true},{"name":"Go","optional":true},{"name":"HIPAA","optional":true},{"name":"Incident Management","optional":true},{"name":"ISO 27001","optional":true},{"name":"ITIL","optional":true},{"name":"Jenkins","optional":true},{"name":"JFrog Xray","optional":true},{"name":"Kubernetes","optional":true},{"name":"NIST AI RMF","optional":true},{"name":"NIST CSF","optional":true},{"name":"OWASP Dependency-Check","optional":true},{"name":"PCI DSS","optional":true},{"name":"Platform Engineering","optional":true},{"name":"Python","optional":true},{"name":"Red Teaming","optional":true},{"name":"SharePoint","optional":true},{"name":"SOC 2","optional":true},{"name":"STRIDE","optional":true},{"name":"Windows Server","optional":true}],"status":"live","first_seen_at":"2026-10-02T00:00:00Z","employer_posted_date":"2026-10-02","last_verified_at":"2026-10-22T03:46:52Z","board_verified":true,"closed_at":null,"days_open":20,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":20},"description":"Company :\nenGenJob Description :\nJOB SUMMARY\n***CANDIDATE MUST BE US Citizen (due to contractual/access requirements)***\nHighmark Health is seeking aSenior Security Engineer to join our Enterprise Application Security team and play apivotal role in shaping how security is built into our software -not bolted on after the fact.\nThis is ahigh-impact, engineering role for a security professional who ispassionate about preventing vulnerabilities before they happen. You will be at the forefront of ourshift-left security strategy, working directly alongside our engineering teams toembed security into every stage of the software development lifecycle - from the first line of code to production deployment.\nIf you thrive at the intersection ofsecurity engineering & architecture,developer enablement & collaboration, andautomation, and you want tobuild something that matters at enterprise scale in one of the nation's leading health and insurance organizations -this role is for you.\nBuild & Enforce Shift-Left Security Controls\nDesign and implement security guardrails that catch vulnerabilities at the earliest possible point in the development process, including withinAI-assisted development workflows, IDEs, at commit time, and within CI/CD pipelines.\nConfigure and enforce pipeline security gates across the enterprise, ensuring code, AI-generated code, infrastructure-as-code, and deployment artifactscannot advance to production without meeting defined security standards.\nDeploy and manage application security scanners, includingSAST, Dependency Scanning, Container Scanning, Secret Detection, DAST, API Security Testing, and emerging AI/LLM security assessment capabilities across the enterprise development platform.\nDevelop security-as-code policies and enforcement rules that scale across a large, distributed engineering organization.\nPartner with Software Delivery Enablement teams to establish security controls, governance requirements, and safe usage patterns forAI coding assistants, AI agents, and AI-enabled developer tooling.\nDrive Vulnerability Risk Reduction\nLead risk-based triage and prioritization of detected vulnerabilities, leveraging exploitability signals such as EPSS scores, Known Exploited Vulnerability (KEV) status, reachability analysis, and emerging AI-specific risk indicators.\nEstablish and track remediation SLAs aligned to vulnerability severity and business risk, with a focus oneliminating Critical and High findings before they reach production.\nIdentify and remediate security risks associated with AI-generated code, AI-enabled applications, model integrations, prompt injection vulnerabilities, insecure agent behaviors, and exposure of sensitive data to AI platforms.\nConduct root cause analysis on recurring vulnerability patterns and drivesystemic improvements through tooling, standards, secure development practices, and developer education.\nMonitor and report on key security health metrics including Mean Time to Remediate (MTTR), security debt trends, pre- versus post-production detection rates, andAI security risk reduction metrics.\nAutomate & Optimize the Security Toolchain\nArchitect and maintain the enterprise application security toolchain, ensuring tools are properly integrated, tuned, and deliveringhigh-fidelity, actionable signal.\nEvaluate, onboard, and operationalize emerging security technologies that improve visibility and governance overAI-assisted software development and software supply chains.\nBuild automation workflows for vulnerability triage, escalation, assignment, and reporting,reducing manual overhead and accelerating response times.\nContinuously optimize scanner configurations to minimize false positives and maximize detection accuracy.\nDevelop dashboards and reporting pipelines that give engineering and security leadershipreal-time visibility into application security posture,AI security adoption, and policy compliance.\nIntegrate security controls and monitoring into approved AI development platforms, coding assistants, model gateways, and agentic development workflows.\nEnable & Empower Developers\nServe as a trusted, embedded security advisor to engineering teams, providinghands-on guidance, code review support, AI security consultation, and practical remediation recommendations.\nDesign and deliver security training, workshops, and reference materials that makesecure coding, secure AI development, and responsible use of AI coding assistants accessible and actionable for developers at all levels.\nBuild and grow a Security Champions program, embedding security advocates within engineering teams to extend the AppSec program's reach across the organization.\nCreate and maintain secure coding standards, secure AI development standards, design patterns, and reusable security libraries that reduce security burden on development teams.\nDevelop guidance and reference architectures for secure implementation ofLLMs, AI copilots, agentic workflows, model integrations, and AI-enabled business applications.\nPartner with development, architecture, and platform teams to embedsecure-by-default AI development practices throughout the SDLC.\nMeasure, Report & Continuously Improve\nDefine, track, and report on AppSec KPIs that demonstrate program effectiveness and drive continuous improvement.\nEstablish and report on AI security metrics such as AI tooling adoption, policy compliance, AI risk assessments completed, AI-generated code review coverage, and identified AI-related security findings.\nConduct regular security posture reviews and present findings, trends, and recommendations to engineering and security leadership.\nSupport audit, risk, and compliance activities by ensuring security controls,AI governance requirements, and secure development standards are documented, measurable, and consistently enforced.\nBenchmark program maturity against industry frameworks such asOWASP SAMM, BSIMM, OWASP Top 10 for LLM Applications, and emerging AI security best practices, driving year-over-year improvement.\nContinuously assess emerging threats, vulnerabilities, and attack techniques affecting modern software delivery pipelines, software supply chains, andAI-enabled applications.\nAssist in AI Application Security & Governance\nAssist with security reviews and threat modeling forAI-enabled applications, LLM integrations, AI agents, and AI-assisted development platforms.\nCollaborate with Security Architecture to recommend and establish technical controls and guardrails supportingenterprise AI governance requirements.\nEvaluate security risks associated with AI models, prompts, training data, model supply chains, MCP integrations, and agentic workflows.\nPartner with Architecture, ISRM, and Software Delivery Enablement teams to definesecure AI development standards and implementation patterns across the enterprise.\nPreferred Qualifications\nExperience withGitLab Ultimate security features including Vulnerability Reports, Security Policies, Compliance Frameworks, and security controls supporting AI-assisted development workflows.\nDeep proficiency with application security scanning tools includingSAST, DAST, SCA/Dependency Scanning, Container Scanning, Secret Detection, API Security Testing, and emergingAI application security assessment capabilities.\nDeep proficiency with JFrog security and compliance tools such asXray and Curation, including Policies, Watches, Impact Analysis, Software Supply Chain controls, and reporting.\nFamiliarity withthreat modeling methodologies such asSTRIDE, PASTA, and their application toAI-enabled systems, LLM integrations, and agentic workflows.\nWorking knowledge of commonAI security risks includingprompt injection, insecure output handling, excessive agency, retrieval risks, model poisoning, training data exposure, sensitive data leakage, and model supply chain threats.\nExperience designing or reviewingsecurity controls for AI-enabled applications, AI assistants, AI agents, or LLM integrations.\nKnowledge of healthcare or financial services regulatory frameworks includingHIPAA, PCI-DSS, SOC 2, NIST CSF, NIST AI RMF, or equivalent governance frameworks.\nIndustry certifications such asCSSLP, GWEB, GWAPT, OSCP, AI Security certifications, or equivalent.\nPrior experience as a software developer. We strongly value candidates who understand what it's like to be on the other side of a security finding and can balance security, delivery, and developer experience.\nExperience coordinating or conductingpenetration testing, red team exercises, AI security assessments, and application threat modeling engagements.\nExperience establishing security controls and governance requirements for AI-assisted software development platforms (e.g., GitLab Duo, GitHub Copilot, Claude Code, Cursor, MCP-based tooling, or equivalent) within a large enterprise environment.\nESSENTIAL RESPONSIBILITIES\nLead teams in clearly defining requirements, deliverables and timeframes. Escalate issues and make recommendations to resolve them to the appropriate audience.\n\nConduct root cause analysis to identify and resolve complex problems impacting ISRM Infrastructure.\n\nDevelop and/or deliver technical training in complex technical areas. Mentor less senior staff in the execution of their duties.\n\nComplete project tasks to enable the on time, within budget and scope delivery of ISRM Infrastructure projects.\n\nImplement, monitor, configure, and maintain security systems.\n\nAssure compliance to required standards, procedures, guidelines and processes.\n\nOther duties as assigned or requested.\n\nREQUIRED EDUCATION\nBachelor's Degree in Computer Science, Information Systems, or closely related field\nSubstitutions\nNone\nPREFERRED EDUCATION\nMaster's Degree in Computer Science, Information Security or related field\nEXPERIENCE\nRequired\n7 years with Information Security and Systems Analysis\n\n7 years with Information Security and/or Information Risk Management and/or Information Technology\n\n7 years with Operating Systems and Software Administration\n\n7 years developing, communicating and presenting Information Security and Risk Management concepts to varying audiences\n\n7 years with technologies such as Intrusion Prevention Systems (IPS), firewalls, endpoint protection, web/email filtering, Data Loss Prevention (DLP), digital rights management, encryption, Security Event and Incident Management (SEIM), and virtualization platforms\n\nPreferred:\n10 years with Information Security and Systems Analysis\n\n7 years in IT / Information Security Risk advisory\n\n7 years in-depth understanding of network security architecture, network and networking protocols\n\n7 in Database Management, System Administration and Software Development Life-Cycle\n\n3 years working within an information security function using the HITRUST Common Security Framework (HITRUST CSF), or the NIST 800-83 cyber security framework\n\nSKILLS\nKnowledge of HITRUST CSF, NIST 800-83 cyber security framework, PCI, HIPAA, HITECH, COBIT, ISO 27001/2, and ITIL 3\n\nFamiliarity with secure SDLC best practices\n\nKnowledge of Microsoft Apps and Suites, Windows server, SharePoint, etc.\n\nStrong teamwork and inter-personal skills\n\nAdditional Skills:\nHands-on experience with CI/CD platforms such as GitLab, GitHub Actions, Jenkins, or equivalent, including security policy enforcement and pipeline governance.\n\nProficiency in at least one scripting or programming language (Python, Go, Bash, or equivalent) for security automation, workflow development, and security tooling integrations.\nFamiliarity with container and cloud-native security concepts including Docker, Kubernetes, cloud provider security services, and modern platform engineering practices.\nAbility to conduct focused secure code reviews and security architecture reviews across both human-authored and AI-generated code.\nExperience evaluating security implications of AI coding assistants, AI agents, MCP-enabled tooling, and AI-powered developer platforms.\nUnderstanding of secure AI development principles, including governance c...","description_format":"text","description_chars":16358,"description_truncated":true,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[{"language":"English","level":"All levels","optional":true}]},"benefits":["Equity","Health insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Hospitals & Health Systems","Health Insurance & Benefits"],"lifecycle":[{"event":"open","at":"2026-10-21T12:21:32Z"}],"visa":[],"liveness":{"score":28,"band":"fade","label":"Fading","p_open":1,"p_active":0.614,"p_room":0.45,"age_days":20,"expected_fill_days":11,"reasons":["conf:2","velocity","win:tail","comp:brand"],"computed_at":"2026-10-22T06:10:10Z"},"pay":{"stated_usd_annual":164600,"is_top_pay":false},"html_url":"https://alion.io/job/highmark-health-senior-security-engineer-secure-sdlc","json_url":"https://alion.io/job/highmark-health-senior-security-engineer-secure-sdlc.json","meta":{"generated_at":"2026-10-22T20:40:51Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4816,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":20346},"rest":"https://alion.io/mcp/rest/get_company?id=20346"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fhighmark-health-senior-security-engineer-secure-sdlc"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fhighmark-health-senior-security-engineer-secure-sdlc"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fhighmark-health-senior-security-engineer-secure-sdlc"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/highmark-health-senior-security-engineer-secure-sdlc\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fhighmark-health-senior-security-engineer-secure-sdlc"}]}