Product Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Evaluate security vulnerabilities in both web and mobile applications, assess risk levels, and lead remediation efforts in collaboration with engineering teams.

• Investigate and document potential product threats, emerging vulnerabilities, and mitigation strategies within the health tech sector.

• Collaborate with Engineering and Product teams to embed security throughout the Software Development Life Cycle (SDLC) and promote secure development methodologies.

• Create and advocate for cost-efficient solutions addressing application and product security challenges.

• Establish product security standards and best practices organization-wide, impacting engineering and architectural decisions.

• Evaluate, audit, and assess the security posture of applications and cloud infrastructures.

• Advise engineering teams on secure coding practices and offer practical security feedback.

• Deploy, enhance, and manage tools such as SAST, DAST, HashiCorp Vault, and other application security solutions.

• Engage in threat modeling for new features and evolving services.

• Perform secure code reviews for services and applications.

• Support targeted penetration testing prior to production releases.

• Collaborate on IT security initiatives related to device management, endpoint protection, access management, and IT hygiene.

• Work alongside DevOps and Infrastructure on cloud architecture, security policies, and cloud-native controls.

• Report directly to the Head of Security as part of the Product Security team.

⛳️ Requirements

• Extensive knowledge of secure software development practices, security-focused architecture, and infrastructure that aligns with product goals and business requirements.

• Practical experience in vulnerability management, secure code reviews, threat modeling, and industry-standard application and product security tools.

• Proficient in at least one scripting language, ideally Python and/or Bash.

• Capability to collaborate effectively with developers, product managers, and cross-functional stakeholders to secure web and mobile applications.

• Adept at assessing, prioritizing, and executing projects autonomously.

• Exceptional written and verbal communication skills.

• 2–4 years of experience in product/application security or 1–3 years in security-focused software engineering.

• Experience in integrating security within agile product delivery methodologies.

• Familiarity with reviewing code changes alongside software engineers and providing security insights.

• Background in building or implementing security controls for AI systems and using AI to enhance security engineering processes.

• Experience in assessing and enhancing AWS cloud security posture through IAM and access reviews, network and environment segmentation, vulnerability management, centralized logging, detection, and secure CI/CD or Terraform controls.

• Candidates must maintain work authorization throughout their employment without employer sponsorship or offered training plans or attestations.

• Familiarity with AWS, GitLab CI/CD, Python, PostgreSQL, Redis, Datadog, Sentry, Terraform, and Packer.

• Bonus: Experience with high-growth startups, SaaS software, in Health Tech, or in software engineering.

🏝️ Benefits

• Medical / Dental / Vision / Disability / Life Insurance

• High Deductible Health Plan with Health Savings Account (HSA) option

• Flexible Spending Account (FSA)

• Access to coaches and therapists through Modern Health's platform

• Flexible Time Off

• Company-wide Collective Pause Days

• Parental Leave Policy

• Family Forming Benefit through Carrot

• Family Assistance Benefit through UrbanSitter

• Professional Development Stipend

• 401k

• Financial Planning Benefit through Origin

• Annual Wellness Stipend for items that enhance overall well-being

• New Hire Stipend to assist with work-from-home setup expenses

• ModSquad Community: Virtual events including active ERGs, holiday-themed activities, team-building events, and more

• Monthly Cell Phone Reimbursement

• Full-time employees are eligible for Modern Health's equity program