Application Security Engineer

Description

The company manages chronic conditions by identifying risk earlier, coordinating care and supporting patients through each stage of their health journey.

Its work aims to reduce emergency visits and improve patient outcomes. The team is collaborative and cares about the impact of its work.

Responsibilities

• Build application security into the full product lifecycle for the clinical platform deployment, patient-facing experiences and planned mobile apps.
• Act as the main security contact for Product and Engineering, securing applications from design through production rather than relying on a late-stage penetration test.
• Set the security requirements, review gates, testing frameworks and remediation routines for a secure, compliant development pipeline.
• Run threat models and set a security baseline for internal environments, patient portals, mobile apps and integration services.
• Maintain data-flow and trust-boundary diagrams, and classify identity, operational and PHI data.
• Work with engineers to add security acceptance criteria to PRDs, technical plans and Jira stories.
• Review architecture for tenant boundaries, server-side authorization, IDOR prevention and lateral movement controls.
• Write and enforce merge request checklists covering authentication, input validation, secrets management and cryptography.
• Design, deploy and run SAST, DAST, SCA and container/IaC scanning tools.
• Test browser workflows and APIs while authenticated, for example with Burp Suite Enterprise.
• Manually test for privilege escalation, SSRF and business-logic abuse.
• Manage the vulnerability intake pipeline, set severities and track fixes against internal SLAs.
• Lead recurring vulnerability reviews with Security, Product and Engineering.
• Coordinate external penetration tests, including scope, vendor choice and tracking of fixes and retests.
• Make sure threat models, test evidence and remediation records meet compliance needs such as HITRUST and SOC 2.

Requirements

• Bachelor's degree in computer science, information security or a related field.
• 3+ years of information security experience for Engineer level, or 5+ years for Senior level, with a focus on application security, DevSecOps or software engineering.
• Hands-on experience adding SAST, DAST and SCA tools to CI/CD pipelines.
• Experience leading or doing application threat modeling, architecture reviews and manual security testing.
• Familiarity with securing cloud SaaS, IaaS and PaaS environments and understanding cloud architecture.
• Internet connection of at least 3.8 Mbps up and 3.0 Mbps down, with latency under 60 ms.
• Ability to travel and work onsite when the business needs it.
• Strong problem-solving and analysis skills, with the ability to assess complex application security issues and propose practical solutions developers can use.
• Clear communication, able to explain technical risk to technical and non-technical audiences.
• Proactive and adaptable, comfortable working inside engineering pods to shift security left.
• Preferred: healthcare experience, including securing PHI environments and working with frameworks such as HITRUST.
• Preferred: deep knowledge of finding and exploiting OWASP Top 10 issues, IDOR, SSRF and authentication bypass.
• Preferred: experience testing and securing complex API integrations, mobile releases and web portals.
• Preferred: familiarity with enterprise dynamic testing tools such as Burp Suite Enterprise and automating security tests against deployed applications.
• Preferred: advanced certifications such as CSSLP, GWAPT, CISSP or CEH.

Conditions

Hybrid role: you work from home and attend the office, clinic or patient home visits when in-person work is needed.

Annual base salary range is $108,500 to $136,000.

The role is eligible for a target annual bonus of 10%.

Final pay depends on location, experience and qualifications.

Benefits

• Medical, dental and vision insurance, employee assistance programs, and employer-paid and voluntary life and disability insurance.
• Health and flexible spending accounts.
• Performance-based bonus, 401k with employer match and financial wellness resources.
• Paid holidays, vacation, sick time, and paid time for birthgiving, bonding, sabbatical and living donor leave.
• Family forming services through Maven Maternity at no cost.
• Physical wellness perks, mental health support and an annual professional development stipend.