Senior Application Security Engineer

Role overview

As the first dedicated security engineer, establish and operate the technical safeguards for a cloud-based healthcare platform. This is a hands-on role spanning application and cloud security, identity, vulnerability response, and security controls for AI-assisted software development. You’ll work across engineering and business teams to prioritize risk and build practical protections into everyday delivery.

Responsibilities

- Lead threat modeling, secure design reviews, and code reviews, with attention to access control and exposed secrets. - Define security gates and independent review controls for AI-assisted development, including procedures for responding when risk increases. - Build identity and secrets management for service accounts, scoped tokens, OAuth grants, and machine credentials. - Secure AWS services and workloads through IAM, network segmentation, logging, encryption, and infrastructure protection. - Configure and enforce code scanning, secret detection, branch protection, and required reviews for sensitive changes. - Assess AI and third-party integrations for health-data flows, retention, and data-loss risks; manage vulnerabilities and penetration testing through remediation. - Support healthcare security safeguards and build detection, response, and automation capabilities.

Requirements

- Bachelor’s degree in computer science or equivalent practical experience. - Six or more years in security engineering, with depth in application or product security and AWS cloud security. - Hands-on experience with secure development tools, such as SAST/DAST, CodeQL, secret scanning, and dependency or supply-chain security. - Strong identity and access management knowledge, including Okta, OAuth/OIDC, SAML, phishing-resistant MFA, and machine identities. - Working knowledge of the HIPAA Security Rule, SOC 2, and the NIST Cybersecurity Framework. - Scripting and automation proficiency in Python and at least one shell; able to explain risk decisions to technical and nontechnical audiences. - Readiness to work as the sole security specialist on a small, cross-functional team.

Nice to have

- Experience securing AI or agentic systems, including prompt injection, agent permissions, and model or supply-chain risks. - Work in healthcare, financial technology, or another data-sensitive environment. - Security certifications such as OSCP, GIAC, AWS Security Specialty, CISSP, or an Okta credential; experience with compliance automation.

Benefits and work setup

- Remote-first work from approved US states. - Salary range of $170,000–$190,000, plus bonus and equity. - Medical, dental, and vision coverage with 90% of employee premiums paid; flexible paid time off, 11 holidays plus one floating holiday, and access to a 401(k).