Senior Application Security Engineer

This is a fully remote position, open to applicants in Alabama, +28 more states.

📋 Description

• Take charge of application and product security through threat modeling, secure design reviews, and secure code assessments.

• Design and manage the security architecture for an agentic software development lifecycle, incorporating phase gates, out-of-band controls, and clawback procedures.

• Develop and maintain non-human identity and secrets management in SaaS and AWS environments.

• Enhance AWS security through IAM, network segmentation, logging, encryption, and workload protection across S3, EKS, and Terraform.

• Implement and optimize GitHub Advanced Security, including CodeQL, secret scanning, push protection, branch protection, and CODEOWNERS review.

• Evaluate AI and third-party vendor integrations prior to access to PHI, assessing data flows, retention, and data-loss prevention strategies.

• Manage vulnerability assessments and the penetration-testing relationship, ensuring findings are addressed effectively.

• Assist with HIPAA Security Rule technical safeguards and develop detection, response, and security automation capabilities.

⛳️ Requirements

• Bachelor's degree in Computer Science or equivalent practical experience.

• Over 6 years of experience in security engineering, specializing in application/product security and AWS cloud security.

• Background in healthcare, fintech, or other regulated, data-sensitive sectors is highly advantageous.

• Practical experience with SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain/dependency security.

• Extensive knowledge of identity and access management, including Okta, OAuth/OIDC, SAML, phishing-resistant MFA, and non-human identity and secrets management.

• Familiarity with or eagerness to learn about AI/LLM and agentic systems security, covering areas like prompt injection, agent authorization and over-permissioning, NHI sprawl, and model/supply-chain risk.

• Capability to function as the sole security expert within a small, cross-functional team and articulate tradeoffs to both technical and non-technical audiences.

• Solid understanding of the HIPAA Security Rule, SOC 2, and the NIST Cybersecurity Framework.

• Proficient in Python and at least one shell scripting language.

• Preferred: OSCP, GIAC, AWS Certified Security–Specialty, CISSP, or Okta Certified Professional credentials.

• Preferred: experience in operating a compliance-automation platform.

🏝️ Benefits

• Salary range of $170,000–$190,000, along with bonuses and significant equity.

• 90% of employee premiums covered for medical, dental, and vision insurance.

• Flexible paid time off (PTO).

• 11 holidays plus 1 floating holiday.

• Eligibility to participate in a 401(k) plan.

• Remote-first work flexibility.

• Ability to work from home from any approved state in the US.