Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Develop and sustain threat models for both new and existing systems and features.

• Analyze committed code to evaluate its security posture.

• Manage Snyk and Docker Scout thresholds, findings, and remediation efforts.

• Examine software bills of materials for outdated or vulnerable components, driving fixes to completion.

• Review SAST and DAST outputs, prioritize findings, and coordinate remediation efforts with engineers.

• Create security utility tools and automation processes for Engineering and the broader organization.

• Develop logging, data parsing, and signal-enrichment scripts.

• Integrate security systems with developer tools.

• Construct and refine detection logic and automation for the Security Analyst team.

• Design penetration tests and AI-assisted attack simulations.

• Utilize Dev, QA, and Test environments to illustrate real exposure scenarios.

• Incorporate Pentest-Tools and internal testing results into future security tools.

• Define, coordinate, and manage independent third-party penetration tests necessary for SOC 2 and HITRUST compliance.

• Monitor penetration test findings until resolution.

• Contribute to security architecture, standards, and detection logic development.

• Advocate for security in mobile app, tablet software, data lake, and AI/ML initiatives.

• Assist in securing the AWS production cloud environment using Aptible, leveraging infrastructure as code where feasible.

• Collaborate closely with Engineering as the primary working partner and occasionally create tools for IT in Microsoft 365.

⛳️ Requirements

• Five to seven years of experience in software or security engineering.

• Proficient in writing code; experience with Python, Go, or similar programming languages.

• Practical application security experience, including threat modeling, dependency and container scanning, and identifying security flaws in code.

• Familiarity with AWS cloud security principles.

• Understanding of CI/CD pipelines and security integration.

• Knowledge of offensive security fundamentals; capacity to think like an attacker and create tests that validate security vulnerabilities.

• Ability to communicate security findings to engineers in a clear and actionable manner.

• Experience with Snyk, Docker Scout, or similar SAST, SCA, and container tooling is preferred.

• Preferred background in detection engineering.

• OSCP-type certification or equivalent demonstrable offensive security experience is preferred.

• Experience in healthcare or other regulated-data environments is preferred.

• Experience building security in an organization where it had not previously been established is preferred.

• Employment is contingent upon successful completion of a background check, in accordance with applicable laws.

🏝️ Benefits

• Full-time remote work opportunity.

• Competitive base salary, with final offers reflecting experience, skills, and location.

• Comprehensive health, dental, and vision benefits package.

• Equity participation in a growing healthcare technology company.

• Paid time off and a culture that values it.

• Collaborative, mission-driven work environment.

• Work that directly supports family caregivers and enhances outcomes for individuals living with dementia.