Application Security Strategist

Labcorp is a global leader in laboratory services, providing the insights and answers that help healthcare providers, patients, researchers, pharmaceutical companies and health systems make confident decisions and improve outcomes. Through our unparalleled science, data, technology and laboratory network, we advance diagnostics, accelerate innovation and help address some of the world’s most important health challenges. As we shape the future of healthcare, we are leveraging advanced technologies, intelligent digital solutions and data-driven innovation across our operations to enhance how work gets done and deliver greater value to customers and patients. With our global scale and deep expertise, you’ll have the opportunity to do meaningful work, grow your career and make a real impact on people’s health around the world. Together, we’re improving health and improving lives. Labcorp is seeking a Application Security Strategist to join our team in a remote capacity. Location : Remote Applicants who live within 35 miles of either the Burlington, NC or Durham, NC location will follow a hybrid schedule. This schedule includes a minimum of three in - office days per week at an assigned location, either Burlington or Durham, supporting both collaboration and flexibility. Work Schedule: This is a full ‑ time , exempt (salaried) position assigned to a First Shift schedule, with standard business hours of Monday through Friday, 8:00 a.m. to 5:00 p.m. in your local time zone. Business needs may occasionally require flexibility in work hours, including earlier, later, or additional hours, with reasonable notice provided when possible. Work Authorization : This position requires permanent authorization to work in the United States without employer sponsorship now or in the future. Sponsorship (including H-1B, OPT/CPT, EAD, or other temporary work authorization) is not available. Job Responsibilities Application Security Design Standards & Patterns Define and document secure development standards and patterns for modern application architectures (web, API, microservices), with guidance grounded in industry best practices such as OWASP and informed by broader frameworks (e.g. NIST, CIS Controls). Develop reusable patterns for common application scenarios such as secure APIs, service-to-service communication and front-end/back-end architecture. Develop reference implementations, code samples, and starter templates that demonstrate secure design patterns in practice and accelerate standards adoption across development teams. Translate complex security risks into clear, developer-focused guidance that can be easily adopted. Contribute to the creation of machine-consumable security patterns to support AI-enabled and automated development tools. Secure Design Enablement Collaborate with engineers and architects during design discussions to provide guidance on secure application architecture and design decisions. Identify common security pitfalls early in the lifecycle. Provide guidance on secure integration and data protection patterns. For example: Input validation and output encoding API security and authentication flows Session management and token handling Secrets management and secure configuration Promote secure-by-design and secure-by-default principles to enable efficient and secure development practices. Support the integration of authentication and authorization patterns within application architecture. Coach development teams on secure implementation of protocols such as OAuth 2.0, OIDC, and SAML. Guide alignment of application security practices with identity and access management, identity governance, and privileged access management solutions. Cross-Functional Collaboration Partner with Digital Identity Services, Cybersecurity Engineering, Product Security Testing, and other teams to provide application security guidance and support risk mitigation. Collaborate with the Governance, Risk, and Compliance team to align application security practices with enterprise policies and regulatory requirements. Work with Cybersecurity Operations to enhance detection and response capabilities for application-level threats. Engage with Enterprise Architecture teams to influence secure design decisions. Support data protection initiatives by advising teams on appropriate controls for sensitive data handling and exposure mitigation. Risk Advisory Review vulnerability patterns and provide guidance on prioritization and remediation of application security risks. Serve as a trusted advisor to engineering and architecture teams, offering practical and actionable security recommendations. Lead the standardization of application security risk management practices across teams. Continuous Improvement and Innovation Stay current with emerging threats, vulnerabilities, and trends in application security. Evaluate and evolve security standards to support cloud native, API first, distributed, and AI enabled applications. Contribute to the development of scalable, consistent application security enablement practices across the organization. Minimum Qualifications 8 or more years of combined experience across application security and software development, with a focus on translating application-layer risks into secure design standards and actionable guidance. 5 or more years of experience applying secure coding principles (OWASP Top 10) and designing or securing web applications, APIs, and microservices architectures. 3 or more years of experience with enterprise security frameworks (NIST CSF, CIS Controls, ISO 27001), secure design patterns, and operating in a consultative cross-functional role. 3 or more years of experience with hands-on application or software development, or equivalent demonstrated experience with the ability to credibly engage developers on secure coding practices and design decisions. 2 or more years of experience securing cloud-native applications in AWS or Azure and working with authentication protocols such as OAuth 2.0, OIDC, and SAML. Preferred Qualifications 3 or more years of experience defining secure development standards, reference architectures, or integrating security into the SDLC, including DevSecOps practices and CI/CD workflows. 2 or more years of experience working with API security frameworks and tooling, with the ability to guide teams on securing modern API-driven architectures. 2 or more years of experience applying threat modeling methodologies to identify design-level risks and guide mitigation strategies with engineering and architecture teams. 2 or more years of experience working with application sec