Application Security Architect

Houston, TXPosted 2 months agoWebsite

Apply on Oceaneering's site →

About This Role

Skip to main content.

American English

Português do Brasil
American English

I am an employee

Are You Still With Us?

It seems you've been gone for a while. For security reasons we will end your session automatically in 03:00 unless you would like to continue working.

End Session Continue Working

action('Decline'), i18nAttr: {'title': 'general.cancel-button', 'aria-label': 'general.cancel-button'}" title="Cancel" aria-label="Cancel">

Work Summary

This summary is generated by AI Assist. Click inside the summary text box to make changes as necessary.

action('Decline')"> Discard action('Accept')"> Add Summary

Personal Job Assistant

Ask Me Something

Attachment

Source: Oceaneering careers · View original posting

About Oceaneering

Oceaneering International, Inc. is a global technology and subsea engineering company based in Houston, Texas. Founded in 1964, it has grown to become the world's largest operator of remotely operated vehicles (ROVs), providing engineered services and robotic solutions primarily to the offshore energy industry. The company also serves sectors such as defense, aerospace, manufacturing, science, and renewable energy. Oceaneering offers a wide range of services, including ROV services, deepwater intervention, non-destructive testing, surveying and mapping, and engineering project management. It manufactures specialized hardware and systems, such as subsea tools, robotic systems, and digital asset management solutions. With a workforce of over 10,000 employees, Oceaneering operates globally, supporting clients in offshore energy, defense, aerospace, and manufacturing industries, while focusing on energy transition and mobility solutions.

Employees

12,000

1940 engineers

Revenue

$2.8B

Website

Visit →

Security at Oceaneering

Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.

3 Intel Signals

Security Philosophy

The stated AppSec mission is to build and operationalize an enterprise application-security program embedded in the SDLC, CI/CD pipelines, and developer ecosystem.
The model combines developer enablement with enforcement: it calls for secure coding guidance, role-based training, playbooks, reference architectures, and daily workflow integration, while also requiring CI/CD gates, traceable builds, verified provenance, remediation SLAs, and no production artifacts bypassing secure pipelines.
The stated risk philosophy is risk-based and business-contextual: the roadmap is aligned to business criticality, crown-jewel applications, and regulatory requirements, while remediation is prioritized using business risk and technical severity.
Stated goals include reducing software-supply-chain risk, eliminating unmanaged builds and compilers, reducing unvetted open-source dependencies and developer-endpoint compromise, identifying design flaws early through threat modeling, and improving visibility through centralized findings and KPIs.

Security Team

As of, public evidence identifies Jay McMickle as Oceaneering’s Chief Information Security Officer, Cheryl Hunt as Manager, Application Security Administration, and Angelique Roncal as Senior Application Security Analyst.
Two publicly identified personnel hold explicit AppSec titles.
The public organization model includes an enterprise AppSec function partnering with Engineering, the Software Center of Excellence (SCOE), and Cybersecurity leadership.
No direct AppSec reporting line is publicly stated.
Active postings: one dedicated enterprise AppSec role—the Application Security Architect, requisition 11137—and one adjacent Oracle Fusion application-security role, requisition 10586.
Repeated requirements include secure SDLC, CI/CD, Zero Trust, SAST, SCA, DAST, software-supply-chain controls, threat modeling, penetration testing, secure coding, centralized findings, and remediation metrics.
A third-party copy also lists Splunk Enterprise, Cribl, Syslog, MDR, and SOC experience, but those requirements are not present in the official 11137 posting and should not be treated as confirmed AppSec tooling.

Key Initiatives

Confirmed initiatives and workflows include: establishing an enterprise AppSec governance framework.
Defining Secure SDLC and vulnerability-management policies.
Standardizing secure pipeline templates and DevSecOps tooling with SCOE.
Creating secure developer environments with centralized builds and controlled access.
Embedding SAST, SCA, DAST, secrets scanning, provenance validation, and CI/CD enforcement.
Expanding testing to web, embedded, ICS, and custom software.
Creating structured penetration testing for crown-jewel applications.
Implementing threat modeling for critical applications.
Aggregating findings into a single application-risk view.
Prioritizing remediation by business risk and technical severity.
Measuring MTTR, pre-release critical-vulnerability closure, and test coverage.
Delivering role-based training, secure coding guidance, playbooks, and reference architectures.
Shift-left evidence is explicit for SDLC embedding, early threat modeling, and CI/CD gates before production.
Pre-commit and IDE controls are not publicly specified.
Vulnerability intake is described through SAST, SCA, DAST, penetration testing, and centralized findings.
Remediation SLAs, remediation tracking, MTTR, and ownership across application teams are stated, but a ticketing platform is not named.
Recent six-month evidence shows the Application Security Architect program being recruited and defined in August 2026.
Public evidence does not establish that the listed programs have been fully deployed or completed.

Preparing for an AppSec interview?

Get the weekly briefing 2,000+ security pros trust.

Interested in this role?

Apply on Oceaneering's site