Senior Application Security Engineer

Senior Application Security Engineer

Alma is on a mission to simplify access to high-quality, affordable mental health care. We do this by making it easy and financially rewarding for therapists to accept insurance and offer in-network care. When a provider joins Alma, they gain access to a suite of tools that not only help them better run their business, but also grow it sustainably and develop as a provider.

Alma is available in all 50 states, with over 20,000 therapists in our growing network. Anyone looking for a therapist can browse Alma’s free directory. Alma has raised $220.5M in funding from Insight Partners, Optum Ventures, Tusk Venture Partners, Primary Venture Partners, First Round Capital, Sound Ventures, Box Group, Cigna Ventures, and Rainfall Ventures. Alma was also named one of Inc’s Best Workplaces in 2022 and 2023.

Alma is seeking a mission-driven Senior Application Security Engineer to join our team. We are dedicated to building secure and compliant tools and services which help mental healthcare providers more easily manage and grow their practice. In this role, you will help validate that our services, applications and web technologies are designed and implemented in a way that meets Alma’s security standards.

You will help analyze, discover, and address security issues across our technical platform.

On this scaling team, you will have a strong hand in defining how Alma's engineering team approaches application security in the software development process. The ideal person for this role loves to work with other teams to design and build amazing security controls and automation.

• Create, manage, and maintain the application security strategy and roadmap, tracking OKRs and work efforts over six quarters.
• Comfortable and excited to lead the application security domain, including managing and maintaining existing tools, executing domain strategies, and owning all aspects of application security.
• Develop, execute, and track the performance of security measures to protect Alma’s data, applications, and systems.
• Gain a deep understanding of Alma’s systems and architecture and the software development processes used to develop it.
• Provide subject matter expertise in the areas of secure coding, application authentication, encryption, AI, and quickly research and become competent in other areas as needed.
• Collaborate with teammates, PMs, and peers to design, develop and implement engineering’s technical security strategy and architecture.
• Collaborate with the Platform Infrastructure team to configure, troubleshoot, and maintain a security infrastructure that monitors and protects against security breaches and intrusions.
• Collaborate with the Developer Experience team to integrate security tools, workflows, and practices into development environments.
• Continually research current and emerging security threats and technologies, proposing changes and guidance that are most impactful.
• Develop appropriate technical solutions along with the latest security tools that help mitigate security vulnerabilities and also help automate repeatable activities.
• Build and provide high-quality application security documentation and training to engineers to set them up for success.
• Educate and train Alma engineering on information system security best practices using our security training solution as well as in-person and recorded training.
• Mature and execute the Threat Modeling program with engineers.
• Implement, manage, and maintain application security tools such as SAST and DAST scanners and own the workflow for remediation of findings.
• Assist with creating the reports for management regarding vulnerabilities, training, and other relevant metrics.

• You have 4+ years of experience working in an application security role.
• You strongly understand the security best practices for the development lifecycle (SDLC).
• You have expert knowledge of web application protocols.
• You have deep technical knowledge of Content Security Policies (CSP) and how to implement them.
• You have strong experience working with AI and understand the areas to focus on to secure it.
• You have expert understanding of application…