Cyber Security Engineer (Application Security)
About The Position
TherapyNotes is seeking an experienced, hands-on Cyber Security Engineer to own application security across the software development lifecycle (SDLC) and CI/CD pipeline. The position focuses on securing CI/CD pipelines, code and dependency scanning workflows, and infrastructure-as-code in a healthcare-regulated environment. The engineer will also contribute to vulnerability management, incident response, and identity and access security as part of a small, collaborative security team. The role partners with development teams to integrate security into the SDLC, assess applications for vulnerabilities, secure GitHub Actions and software supply chains, and review infrastructure-as-code. It also supports healthcare compliance and audits, vulnerability remediation, security tooling and automation, application security incident response, and secure-coding awareness. Participation in an incident-response on-call rotation is expected.
Requirements
- At least 5 years of experience in application security or security engineering.
- Demonstrated experience securing CI/CD pipelines and GitHub Actions, including SAST/DAST, code/secret/dependency-scanning triage, runner and workflow-permission security, and third-party action and supply-chain risk.
- Experience reviewing Terraform or other infrastructure-as-code for security misconfigurations.
- Working knowledge of SIEM, EDR/XDR, and DLP platforms, including deployment, tuning, and alert triage.
- Understanding of Zero Trust architecture principles and their application to application and identity access.
- Strong understanding of healthcare regulations, including HIPAA, HITECH, and HITRUST, and their impact on application security.
- Experience with API security, particularly integrations with other healthcare systems.
- Prior experience securing cloud environments; Azure is preferred and AWS is a plus.
- Willingness to participate in an incident-response on-call rotation.
- Strong collaboration skills and ability to work effectively with cross-functional teams.
- Strong work ethic and willingness to take ownership of projects through completion.
- Eagerness to learn, adapt to new challenges, and stay current with trends and technologies.
Nice To Haves
- Bachelor's degree in information security, computer science, or a related field; equivalent experience may be considered.
- Familiarity with HL7 or other healthcare data standards.
- Industry certifications such as GWAPT, OSWE, GPEN, or an Azure/AWS cloud security certification.
- CISSP or HCISPP certification.
Responsibilities
- Collaborate with development teams to continuously integrate security into the SDLC and CI/CD pipeline.
- Enforce secure coding standards and practices to protect the confidentiality, integrity, and availability of customer data.
- Conduct security assessments, code reviews, and threat modeling to identify application vulnerabilities and risks.
- Own and operate GitHub Advanced Security, triaging code, secret, and dependency-scanning findings; identify recurring vulnerability patterns; recommend broader fixes; and improve scanning coverage, configuration, and workflows.
- Secure CI/CD pipelines and GitHub Actions, including identities, runners, permissions, and secrets; reduce software supply-chain risk through third-party action reviews, dependency controls, action pinning, and artifact provenance.
- Review Terraform and other infrastructure-as-code for security issues and partner with IT platform teams on IaC scanning and secure deployment practices.
- Align application security measures with healthcare regulations and standards, including HIPAA, HITRUST, and HITECH, and support regular audits.
- Collaborate with developers on vulnerability remediation, providing actionable guidance and ensuring effective patching or mitigation.
- Develop, deploy, and manage security tools and technologies, such as SAST, DAST, and vulnerability management systems, to automate security testing and scanning.
- Support application security incident response, identify incident root causes, and contribute to resolution strategies.
- Contribute to development-team security awareness programs focused on secure coding and proactive security measures.
- Participate in an incident-response on-call rotation.
Benefits
- Competitive salary of $110,000–$130,000.
- Employer-sponsored health, dental, vision, life, and disability insurance.
- Retirement plan with company contribution.
- Annual company profit sharing.
- Personal development and training budget.
- Open, collaborative work environment.
- Extensive two-week onboarding plan.
- Comprehensive mentorship program.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
