Cyber Security Engineer – Application Security

This is a fully remote position, open to applicants in Pennsylvania.

📋 Description

• Continuously integrate security into the Software Development Life Cycle (SDLC) and Continuous Integration/Continuous Deployment (CI/CD) pipeline in partnership with development teams.

• Implement secure coding standards and best practices to safeguard the confidentiality, integrity, and availability of customer data.

• Conduct security assessments, code reviews, and threat modeling exercises.

• Manage and utilize GitHub Advanced Security, addressing findings from code, secret, and dependency scanning.

• Recognize recurring vulnerability patterns and enhance scanning coverage, configuration, and workflows.

• Secure GitHub Actions by managing identities, runners, permissions, and secrets.

• Mitigate software supply chain risks through thorough reviews of third-party actions, dependency controls, action pinning, and artifact provenance.

• Assess Terraform and other infrastructure-as-code for security vulnerabilities.

• Collaborate with IT platform teams on Infrastructure as Code (IaC) scanning and secure deployment methodologies.

• Ensure that application security practices comply with HIPAA, HITRUST, and HITECH regulations, and assist in regular audits.

• Work alongside developers to resolve vulnerabilities and guarantee timely patching or mitigation.

• Design, implement, and manage Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and vulnerability management tools.

• Support application security incident responses, conducting root-cause analyses and developing resolution strategies.

• Contribute to secure coding awareness initiatives for development teams.

⛳️ Requirements

• A Bachelor's degree in information security, computer science, or a related field is preferred; equivalent experience will be considered.

• A minimum of 5 years of experience in application security or security engineering.

• Proven ability to secure CI/CD pipelines and GitHub Actions, encompassing SAST/DAST, code/secret/dependency-scanning triage, runner and workflow permission security, and third-party action/supply chain risk management.

• Experience in reviewing Terraform or other infrastructure-as-code for security misconfigurations.

• Proficient understanding of SIEM, EDR/XDR, and DLP platforms, including their deployment, tuning, and alert triage.

• Knowledge of Zero Trust architecture principles and their application in managing application and identity access.

• Strong comprehension of HIPAA, HITECH, and HITRUST regulations and their implications for application security.

• Familiarity with API security, especially in relation to integrations with other healthcare systems.

• Preferably experienced in Azure cloud security; AWS experience is a plus.

• Willingness to participate in an incident response on-call rotation.

• Industry certifications such as GWAPT, OSWE, GPEN, or Azure/AWS cloud security certifications are ideal; CISSP or HCISPP certifications are a plus.

• Preference for familiarity with HL7 or other healthcare data standards.

🏝️ Benefits

• Employer-sponsored health, dental, vision, life, and disability insurance.

• Retirement plan with company contributions.

• Annual profit-sharing opportunities.

• Personal development and training budget.

• Open and collaborative work environment.

• Comprehensive 2-week onboarding program.

• Extensive mentorship program.