Threat Modeling Engineer

Job DescriptionThe CVS Health Secure Development Services team within Enterprise Information Security is seeking a Threat Modeling Engineer to identify and communicate threats and mitigations within our applications and systems. The Engineer in this role will meet with application teams and system owners to evaluate existing solutions and new proposals to evaluate and identify the potential risks and threats. You will document the results for the purpose of reporting the risks and proposed options for mitigation. Primary Job Duties & Responsibilities: - Threat model applications, systems, and platforms with a focus on security best practices and data protection requirements - Participate in design sessions for proposed system solutions - Engage application teams through an intake process to identify security requirements - Routinely report on progress and results - Prioritize engagements and work in a fast-paced environmentPay RangeThe typical pay range for this role is:Minimum: 90,000Maximum: 180,000Please keep in mind that this range represents the pay range for all positions in the job grade within which this position falls. The actual salary offer will take into account a wide range of factors, including location.Required Qualifications-5+ years of experience with cyber security -3+ years of proven experience with threat modeling and risk assessments-3+ years of experience working with OWASP and NIST security standards and frameworks-1+ year of experience with application development such as modern SDLC including CI/CD pipelines, cloud architecture, API communications, and container deployment- 1+ year of experience with modern authentication and authorization mechanisms such as OpenID, OAuth, and SAML- Understanding of common application security vulnerabilities and controls to remediate these weaknesses- Understanding of industry standards as they relate to application security and data protection to include NIST, HIPAA, PCI, - Solid interpersonal skills to adapt personal communication styles to the style of othersPreferred Qualifications-3+ year of programming experience in Java or C# -Security Certifications a plus (e.g., CSSLP, CISSP, GSEC)EducationBachelor's Degree or Equivalent ExperienceBusiness OverviewBring your heart to CVS Health Every one of us at CVS Health shares a single, clear purpose: Bringing our heart to every moment of your health. This purpose guides our commitment to deliver enhanced human-centric health care for a rapidly changing world. Anchored in our brand - with heart at its center - our purpose sends a personal message that how we deliver our services is just as important as what we deliver. Our Heart At Work Behaviors support this purpose. We want everyone who works at CVS Health to feel empowered by the role they play in transforming our culture and accelerating our ability to innovate and deliver solutions to make health care more personal, convenient and affordable. We strive to promote and sustain a culture of diversity, inclusion and belonging every day. CVS Health is an affirmative action employer, and is an equal opportunity employer, as are the physician-owned businesses for which CVS Health provides management services. We do not discriminate in recruiting, hiring, promotion, or any other personnel action based on race, ethnicity, color, national origin, sex/gender, sexual orientation, gender identity or expression, religion, age, disability, protected veteran status, or any other characteristic protected by applicable federal, state, or local law. We proudly support and encourage people with military experience (active, veterans, reservists and National Guard) as well as military spouses to apply for CVS Health job opportunities.

Created: 2026-03-07