Staff Application Security Engineer – AI & Agentic Systems

CVS Health is seeking a Staff Application Security Engineer focused on AI and agentic systems. This onsite role in New York, NY helps strengthen secure-by-design practices across application and AI lifecycles, partnering with engineering, product, platform, and data teams to embed application and AI security from early architecture through testing and incident response.

You will set standards and guardrails for AI-enabled applications, guide teams on secure patterns for agents and generative workflows, and help align security controls with organizational requirements through close collaboration across security, privacy, compliance, legal, and risk partners.

What you’ll do

• Develop and maintain application and AI security standards, best practices, and guardrails.
• Promote secure-by-design principles across application and AI development lifecycles.
• Establish secure design patterns for AI agents, prompt management, tool integrations, memory handling, and autonomous workflows.
• Partner with engineering teams to identify and mitigate AI-specific risks including prompt injection, model abuse, data leakage, and unauthorized agent actions.
• Serve as a subject matter expert supporting the security of AI-enabled applications and agentic systems.
• Review and advise architectures using large language models, retrieval augmented generation pipelines, AI agents, and AI-powered workflows.
• Define and recommend identity, authorization, data protection, observability, and governance controls for AI environments.
• Conduct threat modeling, architecture reviews, and security assessments for applications and AI-enabled systems.
• Perform security analysis of AI workflows, model integrations, agent interactions, and data flows.
• Collaborate with teams to prioritize and remediate security findings.
• Evaluate emerging AI security tools and technologies to improve organizational security posture.
• Influence security controls adoption in development processes and product roadmaps.
• Support investigation and response for application and AI-related security events, including root-cause identification and long-term improvements.
• Drive continuous improvement of security controls, processes, and engineering practices.
• Mentor security engineers and development teams on secure coding, threat modeling, and AI security best practices.
• Contribute to application and AI security strategy through technical leadership and innovation.

Minimum qualifications

• 7+ years of experience designing, building, or securing enterprise-scale applications and platforms.
• 5+ years of application security experience, including threat modeling, secure design, code review, and vulnerability management.
• 5+ years of programming experience in one or more languages such as Python, Java, JavaScript, C#, or Go.
• 3+ years of experience developing or securing AI, machine learning, or generative AI solutions.
• 3+ years of experience with public cloud platforms including AWS, Azure, or Google Cloud Platform.
• Bachelor’s degree from an accredited college or university (or equivalent combination of education and relevant work experience).

Technologies

Python, Java, JavaScript, C#, Go, AWS, Azure, Google Cloud Platform

Compensation and incentives

Pay range: USD 106,605 - 284,280 per year.

• Eligible for a CVS Health bonus, commission, or short-term incentive program in addition to the base pay range listed above.
• Eligible for an equity award program with an award target.

Benefits

• Medical, dental, and vision coverage
• Paid time off
• Retirement savings options
• Wellness programs
• Other resources, based on eligibility
• CVS Health bonus, commission or short-term incentive program (eligible in addition to base pay range)
• Award target in the company’s equity award program

Great benefits for great people: This full-time position is eligible for a comprehensive benefits package designed to support the physical, emotional, and financial well-being of colleagues and their families.

Preferred qualifications

• Experience securing modern application architectures, including APIs, containers, microservices, and serverless technologies.
• Strong understanding of secure software development lifecycle practices and application security testing methodologies.
• Hands-on experience securing AI agents, retrieval augmented generation solutions, and large language model integrations.
• Experience conducting threat modeling and security assessments for AI-enabled systems.
• Familiarity with responsible AI principles, AI governance, and emerging AI security frameworks.
• Experience integrating security controls into continuous integration and continuous delivery pipelines.
• Knowledge of common compliance frameworks such as PCI DSS, HIPAA, NIST, HITRUST, and CSA.
• Ability to influence technical decisions across multiple teams and organizations.
• Experience contributing to security research, open-source projects, or industry communities.