Staff Application Security Engineer

About the role

If you are wondering what makes Trimedx different, it's that all of our associates share in a common purpose of serving clients, patients, communities, and each other with equal measures of care and performance.

• Everyone is focused on serving the customer and we do that by collaborating and supporting each other
• Associates look forward to coming to work each day
• Every associate matters and makes a difference

It is truly a culture like no other - We hope you will join our team! Find out more about our company and culture here.

Accountabilities

• Own the AppSec program strategy and roadmap; define security architecture standards for web and cloud-native workloads (~30% of time).
• Manage the exception and waiver process; report program health and metrics to IT leadership quarterly.
• Embed with development teams at the architecture and design phase, not just code review; run threat modelling (STRIDE or equivalent) for new systems and significant features (~25% of time).
• Build and sustain a security champions program; deliver developer security training calibrated to skill level.
• Design and own the AppSec toolchain - SAST, SCA, secrets scanning, container image scanning, DAST; integrate tools into CI/CD pipelines; own findings triage and false-positive reduction (~20% of time).
• Conduct or commission architecture security reviews for new platforms and major system changes; scope and coordinate external penetration testing; track remediation within SLA (~15% of time).
• Maintain audit-ready evidence for ISO 27001 Annex A.8 controls; support SOC 2 secure-development criteria; own the AppSec risk register; participate in audits as the subject matter expert (~10% of time).
• Serve as the primary interface between application teams, infrastructure security, and IT leadership on AppSec matters.
• Track emerging AI security trends and support safe AI adoption within InfoSec and across the broader company.

Problem Solving and Analysis

• Distinguishes between gatekeeping and enabling models; designs controls that scale across 6-10 development teams without becoming a bottleneck.
• Evaluates competing tools and approaches and produces defensible, documented architecture decisions without needing an existing playbook.
• Applies pattern recognition from prior program-build experience to problems with long-lived, organization-wide consequences.
• Prioritizes security debt against capacity constraints and recommends risk-based trade-offs.

Decision Making / Autonomy

• Operates with a high degree of autonomy: arrives with a point of view, validates it against Trimedx's context in the first 30 days, and executes with confidence.
• Makes and documents security architecture decisions that stand up to scrutiny.
• Escalates highly complex, cross-functional, or resourcing issues to IT leadership; day-to-day program decisions are made independently.
• Owns the AppSec program and its outcomes; is not primarily a reviewer of individual pull requests or a responder to individual incidents.

Communications & Interactions

• Reports program health, findings, and metrics to IT leadership on a recurring cadence.
• Leads threat modelling sessions and design reviews with development teams.
• Writes security standards, risk summaries, and program reports that are clear to a non-technical VP audience.
• Builds credibility and drives security outcomes through relationship and technical influence rather than authority.
• Serves as the organizational voice for secure development practices with leadership, development teams, and external pen-testing vendors.
• undefined
• All other duties as assigned.

#LI-Remote

At Trimedx, we are committed to cultivating a workplace culture where every associate feels valued, supported, and empowered to thrive. This culture reflects our belief that our people are our foundation, their well-being is essential, and shared success is built through meaningful work, recognition, and opportunities for growth.

• Visit our website to view our Workplace Culture Commitment, along with our social channels to see what our team is up to: Facebook, LinkedIn, Twitter.
• Trimedx is an Equal Opportunity Employer. Drug-Free Workplace.
• Trimedx may also provide associates with benefits that include health/dental/vision, HSA/FSA, matching retirement plans, paid vacation and parental leave, adoption/infertility assistance, and more!