AVP Cybersecurity

Thank you for considering a career at Ensemble! Ensemble is a leading provider of technology-enabled revenue cycle management solutions for health systems, including hospitals and affiliated physician groups. They offer end-to-end revenue cycle solutions as well as a comprehensive suite of point solutions to clients across the country. Ensemble keeps communities healthy by keeping hospitals healthy. We recognize that healthcare requires a human touch, and we believe that every touch should be meaningful. This is why our people are the most important part of who we are. By empowering them to challenge the status quo, we know they will be the difference! O.N.E Purpose: Customer Obsession: Consistently provide exceptional experiences for our clients, patients, and colleagues by understanding their needs and exceeding their expectations. Embracing New Ideas: Continuously innovate by embracing emerging technology and fostering a culture of creativity and experimentation. Striving for Excellence: Execute at a high level by demonstrating our “Best in KLAS” Ensemble Difference Principles and consistently delivering outstanding results. The Opportunity: The AVP, Application Security (DevSecOps) is a working, hands-on leader who builds, runs, and matures the organization's application security program while remaining an active technical contributor. This role owns secure software development lifecycle (SDLC) strategy, DevSecOps tooling and automation, and application-layer vulnerability management, while also mentoring engineers and security team members and personally performing security architecture reviews, threat modeling, and critical vulnerability triage when needed. The Director partners closely with engineering, product, and infrastructure leaders to embed security into every stage of the software development lifecycle and reports on application risk posture to executive leadership. Job Competencies Valuing Differences - Works effectively with individuals of diverse cultures, interpersonal styles, abilities, motivations, or backgrounds; seeks out and uses unique abilities, insights, and ideas. Considers the collective. Collaboration - Works cooperatively within teams and partners with others, both internally and externally as needed, to achieve success; focuses on the results of the team, not the achievements of one person. It’s “All for One and One for All” Accountability - Accepts personal responsibility and/or consequences of failure and successes, delivering on commitments and refocusing effort when needed. Someone who is willing to step up and own it. Time Management - Effectively manages personal time and resources to ensure that work is completed efficiently. Developing Trust - Gains others’ confidence by acting with integrity and following through on commitments; treats others and their ideas with respect and supports them in the face of challenges Takes Initiative - Takes prompt action to accomplish goals and achieve results beyond what is required; is proactive and pursues relentlessly. Essential Job Functions Build, lead, and continuously mature a comprehensive application security (AppSec) and DevSecOps program spanning secure SDLC, SAST/DAST/SCA, container and cloud-native security, and API security. Serve as a working, hands-on member of the team: perform secure code reviews, threat modeling, security architecture reviews, and hands-on remediation guidance alongside individual contributors, not just through delegation. Mentor and develop application security engineers and embedded security champions, providing technical guidance, pairing on complex issues, and building the team's long-term technical capability. Design, implement, and tune the AppSec toolchain (e.g., SAST, DAST, SCA, container scanning, secrets detection) and integrate security gates into CI/CD pipelines in partnership with engineering teams. Own the application vulnerability management program, including triage, prioritization, remediation SLAs, and escalation of critical findings, personally leading response on high-severity issues. Partner with engineering, product, and architecture teams to embed security requirements and threat modeling into the design phase of new products and features ("shift-left"). Develop and maintain application security policies, secure coding standards, and DevSecOps playbooks, and train engineering staff on secure development practices. Manage third-party and open-source software risk, including software composition analysis and remediation of vulnerable dependencies. Report on application security risk posture, program metrics, and remediation trends to executive leadership and other stakeholders. Participate in application-level security incident response, including root cause analysis and remediation planning. Other Preferred Knowledge, Skills and Abilities 8+ years of experience in application security, secure software development, or DevSecOps, including hands-on engineering or security engineering work 3+ years in a leadership or technical lead capacity, with a demonstrated ability to remain hands-on while managing or mentoring a team Relevant certification preferred (e.g., CSSLP, OSCP, GWAPT, CISSP) and familiarity with frameworks such as OWASP ASVS, OWASP Top 10, and NIST SSDF Hands-on experience with SAST, DAST, and SCA tools (e.g., Checkmarx, Veracode, Snyk, Semgrep, Fortify) and the ability to configure, tune, and troubleshoot them directly Working proficiency in one or more programming languages (e.g., Java, Python, JavaScript/TypeScript, Go, C#) sufficient to review code and build automation or tooling Experience integrating security into CI/CD pipelines and DevOps toolchains (e.g., Jenkins, GitHub Actions, GitLab CI, Azure DevOps) Experience with cloud security and container/orchestration security (e.g., AWS, Azure, or GCP; Docker, Kubernetes) Experience conducting threat modeling (e.g., STRIDE) and security architecture reviews Experience building and scaling a vulnerability management program, including remediation SLAs and executive reporting Strong communication and presentation skills, with the ability to translate technical risk for non-technical stakeholders Ability to work independently, lead a highly skilled AppSec team, and remain a credible technical practitioner Strong analytical and critical thinking skills, with the ability to prioritize under pressure and meet deadlines This position pays between $171,750-257,700 based on experience Must be inquisitive and demonstrate openness to innovation including AI to explore better processes and ways to alleviate friction and improve patient and client experiences This is a remote position; however, candidates must be willing and able to travel to and work onsite at client, temporary, or corporate office locations as business needs require This posting addresses s state specific requirements to provide pay transparency. Compensation decisions consider many job-related factors, including but not limited to geographic location; knowledge; skills; relevant experience; education; licensure; internal equity; time in position. A candidate entry rate of pay does not typically fall at the minimum or maximum of the role’s range. #LI-LP1 #LI-Remote Join an award-winning company Five-time winner of “Best in KLAS” 2020-2022, 2024-2025 Black Book Research's Top Revenue Cycle Management Outsourcing Solution 2021-2024 22 Healthcare Financial Management Association (HFMA) MAP Awards for High Performance in Revenue Cycle 2019-2024 Leader in Everest Group's RCM Operations PEAK Matrix Assessment 2024 Clarivate Healthcare Business Insights (HBI) Revenue Cycle Awards for strong performance 2020, 2022-2023 Energage Top Workplaces USA 2022-2024 Fortune Media Best Workplaces in Healthcare 2024 Monster Top Workplace for Remote Work 2024 Great Place to Work certified 2023-2024 Innovation Work-Life Flexibility Leadership Purpose + Values Bottom line, we believe in empowering people and giving them the tools and resources needed to thrive. A few of those include: Associate Benefits – We offer a comprehensive benefits package designed to support the physical, emotional, and financial health of you and your family, including healthcare, time off, retirement, and well-being programs. Our Culture – Ensemble is a place where associates can do their best work and be their best selves. We put people first, last and always. Our culture is rooted in collaboration, growth, and innovation. Growth – We invest in your professional development. Each associate will earn a professional certification relevant to their field and can obtain tuition reimbursement. Recognition – We offer quarterly and annual incentive programs for all employees who go beyond and keep raising the bar for themselves and the company. Ensemble is an equal employment opportunity employer. It is our policy not to discriminate against any applicant or employee based on race, color, sex, sexual orientation, gender, gender identity, religion, national origin, age, disability, military or veteran status, genetic information or any other basis protected by applicable federal, state, or local laws. Ensemble also prohibits harassment of applicants or employees based on any of these protected categories. Due to business, operational, payroll, and regulatory requirements, this position is limited to individuals who reside and are authorized to work within the United States. Applications generated from outside the United States will not be considered. Individuals may reapply when located within the United States. Ensemble provides reasonable accommodations to qualified individuals with disabilities in accordance with the Americans with Disabilities Act and applicable state and local law. If you require accommodation in the application process, please contact . This posting addresses state specific requirements to provide pay transparency. Compensation decisions consider many job-related factors, including but not limited to geographic location; knowledge; skills; relevant experience; education; licensure; internal equity; time in position. A candidate entry rate of pay does not typically fall at the minimum or maximum of the role’s range. Employment Disclaimers – Ensemble