Security Engineer

Own application security across an AI-enabled healthcare marketplace. You'll design privacy-by-design controls, build a secure SDLC, threat-model new features (including AI features), and partner with product teams to ship fast and safely.

Remote (US)

Full-time

App Sec ownership Define and drive the application security program for patient, provider, and internal apps/APIs; build pragmatic, developer-friendly controls.

Threat modeling Structured models for new features (incl. AI/RAG/search, payments, messaging), covering authn/z, data flows, third parties, and abuse cases.

Privacy by design Enforce data minimization, purpose limitation, strong encryption, least privilege, and clear PHI boundary (no PHI to non-compliant endpoints).

Developer enablement Templates, secure defaults, linters, and quick paths to fix. Opinionated guidance beats policy-only approaches.

Domain

Focus

Examples

Authentication & Authorization Modern auth (OIDC/OAuth2), session mgmt, step-up auth for sensitive actions. Rotate secrets, short tokens, hardened cookies, RBAC/ABAC, JTI revocation.

Input/Output Handling Injection prevention, SSRF/XSS/XXE defenses, content sanitization. Centralized encoders, CSP, template auto-escape, signed URLs.

Data Protection Encrypt at rest & transit, KMS/HSM, key rotation, field-level encryption for sensitive PII/PHI. TLS 1.2+, KMS CMKs, envelope encryption, tokenization/pseudonymization.

Secrets & CI/CD Secret scanning, sealed secrets, workload identity, build integrity. SBOM, provenance attestations, SLSA concepts, branch protections.

Third Parties & SaaS Vendor risk, DPA/BAA checks, least data sharing, key escrow. Scopes per integration, signed webhooks, egress allow-lists.

Abuse & Fraud Rate limits, anomaly detection, anti-automation, account take-over defenses. Device signals, captcha alternatives, velocity and behavior models.

Our AI features must be safe, privacy-preserving, and resilient to prompt-level and supply-chain attacks. Simpler non-AI solutions are preferred where they outperform or reduce risk.

• Threat-model AI surfaces: prompt injection, data exfiltration, jailbreaks, model/embedding poisoning, supply chain of providers and datasets.
• Guardrails: retrieval over generation for sensitive flows, allow-lists, output filters, role-separated contexts, and human-in-the-loop for risky actions.
• Data boundary:
  no PHI or consumer health data to non-approved LLM endpoints; use vetted providers/regions and signed BAAs where required.
• Evaluation: offline eval sets, red-teaming, and regression gates before rollout; monitor drift, latency, and cost.
• Observability: structured logs with redaction, privacy-preserving telemetry, and differential alerting for anomalies.

HIPAA boundary, state consumer health privacy (e.g., WA "My Health My Data"), CPRA/CPPA and GDPR principles apply to model inputs/outputs and storage.

Stage

Security activities

Tooling (illustrative)

Design Threat models, data-flow diagrams, privacy impact checks, crypto decisions. Architectural RFCs, STRIDE, data catalogs, key mgmt runbooks.

Build Secure frameworks, dependency hygiene, secrets mgmt, parameterized queries. SBOM, Dependabot/Renovate, KMS, IAM roles, secret scanners.

Test SAST/DAST/IAST, unit/contract tests incl. security assertions, fuzzing. Static analyzers, container scanners, ZAP/Burp, fuzzers.

Release Signed builds, policy gates, change approvals, staged rollouts. CI attestations, OPA/Conftest, deploy diff checks.

Operate Runtime protections, WAF, IDS/IPS, secrets rotation, backup/restore tests. WAF/CDN, CSP, SIEM, EDR, KMS rotation jobs, chaos drills.

• Runbooks for P0/P1, on-call…