Application Security Engineer
About The Position
The Application Security Engineer embeds application security into Strive Health’s product development lifecycle, supporting the deployment of Canvas Medical, patient-facing experiences, and future mobile applications. This role serves as the primary security partner for Product and Engineering, helping ensure applications are built securely from design through production. The engineer establishes security requirements, review gates, testing frameworks, and remediation processes to support a secure and compliant development pipeline. The role covers threat modeling and security baselines; secure architecture and product development; application security testing; vulnerability management and remediation; and compliance and audit readiness. It includes collaborating directly with engineering teams, testing browser workflows and APIs, coordinating external penetration tests, and maintaining documentation and evidence aligned with internal compliance needs such as HITRUST and SOC 2. The position offers hybrid-remote flexibility, with travel and onsite work required to meet business needs.
Requirements
- Bachelor’s degree in Computer Science, Information Security, or a related field.
- Three or more years of information security experience for Engineer level, or five or more years for Senior level, with a strong focus on Application Security, DevSecOps, or software engineering.
- Demonstrable experience integrating security tools such as SAST, DAST, and SCA into CI/CD pipelines.
- Experience leading or performing application threat modeling, architecture reviews, and manual security testing.
- Familiarity with securing cloud environments (SaaS, IaaS, and PaaS) and understanding of cloud architecture.
- Internet connectivity with minimum speeds of 3.8 Mbps download and 3.0 Mbps upload, and latency under 60 ms.
- Ability to travel and be onsite to meet business needs.
- Excellent problem-solving and analytical skills, including the ability to assess complex application security issues and provide practical, developer-friendly solutions.
- Strong communication and collaboration skills, including the ability to articulate technical risk to technical and non-technical stakeholders.
- Proactive and adaptable approach, with comfort embedding directly with engineering pods to shift security left.
Nice To Haves
- Healthcare-sector experience securing environments that manage PHI and complying with frameworks such as HITRUST.
- Deep expertise identifying and exploiting vulnerabilities, including OWASP Top 10, IDOR, SSRF, and authentication bypass.
- Experience testing and securing complex API integrations, mobile application releases, and web-based portals.
- Familiarity with enterprise dynamic testing tools such as Burp Suite Enterprise and automating security testing against deployed applications.
- Advanced application security or information security certifications, such as CSSLP, GWAPT, CISSP, or CEH.
Responsibilities
- Perform threat modeling and establish security baselines for internal environments, patient portals, mobile applications, and integration services.
- Maintain data-flow and trust-boundary diagrams and assess identity, operational, and PHI data classifications.
- Embed security acceptance criteria into product requirements documents, technical plans, and Jira stories in collaboration with engineering teams.
- Conduct architecture reviews focused on tenant boundaries, server-side authorization, IDOR prevention, and guardrails against lateral movement.
- Develop and enforce merge request checklists covering authentication, input validation, secrets management, and cryptography.
- Design, deploy, and operate application security testing tools, including SAST, DAST, Software Composition Analysis, and container and infrastructure-as-code scanning.
- Perform authenticated testing of browser workflows and APIs, including with tools such as Burp Suite Enterprise.
- Manually test for complex vulnerabilities, including privilege escalation, SSRF, and business-logic abuse.
- Manage vulnerability intake, assign severities, and track remediation against internal SLAs.
- Lead recurring vulnerability review sessions with Security, Product, and Engineering stakeholders.
- Coordinate external penetration tests, including scoping, vendor selection, and remediation and retesting tracking.
- Ensure security requirements, threat models, testing evidence, and remediation documentation align with internal compliance needs, such as HITRUST and SOC 2.
Benefits
- Medical, dental, and vision insurance.
- Employee assistance programs.
- Employer-paid and voluntary life and disability insurance.
- Health and flexible spending accounts.
- Performance-based bonus program.
- 401(k) with employer match.
- Financial wellness resources.
- Paid holidays, vacation time, and sick time.
- Paid birthgiving, bonding, sabbatical, and living donor leaves.
- Family-forming services through Maven Maternity at no cost.
- Physical wellness perks and mental health support.
- Annual professional development stipend.
- Hybrid-remote flexibility.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
