Cyber Security Engineer (Application Security)

Remote: yes Posted: 2026-11-03

- Bachelor's degree in information security, computer science, or related field preferred; equivalent experience considered.

- 5+ years in application security or security engineering.

- Demonstrated experience securing CI/CD pipelines and GitHub Actions — including SAST/DAST, code/secret/dependency-scanning triage (e.g., GitHub Advanced Security, Snyk), runner and workflow-permission security, and third-party action/supply-chain risk.

- Experience reviewing Terraform or other infrastructure-as-code for security misconfigurations.

- Working knowledge of SIEM, EDR/XDR, and DLP platforms — deployment, tuning, and alert triage.

- Understanding of Zero Trust architecture principles and how they apply to application and identity access.

- Strong understanding of healthcare regulations (HIPAA, HITECH, HITRUST) and their impact on application security.

- Experience with API security, particularly integrations with other healthcare systems; familiarity with HL7 or other healthcare data standards preferred.

- Prior experience securing cloud environments (Azure preferred, AWS a plus).

- Willingness to participate in an incident response on-call rotation.

- Industry certifications such as GWAPT, OSWE, GPEN, or a cloud security certification (Azure/AWS) are ideal; CISSP or HCISPP a plus but not a substitute for hands-on tooling experience.

Application Security Responsibilities

- Collaborate with developmental teams to ensure security is continuously integrated into the Software Development Lifecycle (SDLC) and CI/CD pipeline.

- Enforce secure coding standards and best practices to minimize vulnerabilities and to protect the confidentiality, integrity, and availability of our customer's data.

- Perform in-depth security assessments, code reviews, and threat modeling on applications to identify potential vulnerabilities and risks.

- Own and operate GitHub Advanced Security — triage code, secret, and dependency-scanning findings, identify recurring vulnerability patterns and recommend broader fixes, and continuously improve scanning coverage, configuration, and workflows.