Cyber Security Engineer (Application Security)
About The Position
TherapyNotes is seeking an experienced, hands-on Cyber Security Engineer to own application security across its software development lifecycle (SDLC) and CI/CD pipeline. The role focuses on securing CI/CD pipelines, code and dependency scanning workflows, and infrastructure-as-code in a healthcare-regulated environment involving HIPAA, HITRUST, and HITECH. The engineer will also contribute to broader security engineering activities, including vulnerability management, incident response, and identity and access security, as part of a small, collaborative security team. The position partners with development and IT platform teams to integrate security into software delivery, assess and remediate application risks, operate security scanning tools, and support regulatory compliance and audits. It includes participation in an incident response on-call rotation.
Requirements
- At least 5 years of experience in application security or security engineering.
- Demonstrated experience securing CI/CD pipelines and GitHub Actions, including SAST/DAST, code, secret, and dependency-scanning triage; runner and workflow-permission security; and third-party action and supply-chain risk.
- Experience reviewing Terraform or other infrastructure-as-code for security misconfigurations.
- Working knowledge of SIEM, EDR/XDR, and DLP platforms, including deployment, tuning, and alert triage.
- Understanding of Zero Trust architecture principles and their application to application and identity access.
- Strong understanding of healthcare regulations, including HIPAA, HITECH, and HITRUST, and their impact on application security.
- Experience with API security, particularly integrations with other healthcare systems.
- Prior experience securing cloud environments.
- Willingness to participate in an incident response on-call rotation.
- Strong collaboration skills and ability to work effectively with cross-functional teams.
- Passion for continuous learning and staying current with security trends and technologies.
- Ability to engage with new challenges and adapt quickly.
- Strong work ethic and ownership of projects through completion.
Nice To Haves
- Bachelor's degree in information security, computer science, or a related field; equivalent experience is considered.
- Familiarity with HL7 or other healthcare data standards.
- Azure cloud security experience; AWS experience is a plus.
- Certifications such as GWAPT, OSWE, GPEN, or an Azure/AWS cloud security certification.
- CISSP or HCISPP certification.
Responsibilities
- Collaborate with development teams to integrate security throughout the SDLC and CI/CD pipeline.
- Enforce secure coding standards and practices to protect the confidentiality, integrity, and availability of customer data.
- Conduct security assessments, code reviews, and threat modeling to identify application vulnerabilities and risks.
- Own and operate GitHub Advanced Security by triaging code, secret, and dependency-scanning findings; identifying recurring vulnerability patterns; recommending broader fixes; and improving scanning coverage, configuration, and workflows.
- Secure GitHub Actions and CI/CD pipelines, including identities, runners, permissions, and secrets; reduce software supply-chain risk through third-party action reviews, dependency controls, action pinning, and artifact provenance.
- Review Terraform and other infrastructure-as-code for security issues and partner with IT platform teams on IaC scanning and secure deployment practices.
- Align application security measures with healthcare regulations and standards, including HIPAA, HITRUST, and HITECH, and support regular audits.
- Work with developers to remediate vulnerabilities and provide actionable guidance on patching or mitigation.
- Develop, deploy, and manage security tools and technologies, such as SAST, DAST, and vulnerability management systems, to automate testing and scanning.
- Support application security incident response, help identify root causes, and contribute to resolution strategies.
- Contribute to development-team security awareness programs focused on secure coding and proactive security measures.
- Participate in an incident response on-call rotation.
Benefits
- Employer-sponsored health, dental, vision, life, and disability insurance
- Retirement plan with company contribution
- Annual company profit sharing
- Personal development and training budget
- Open, collaborative work environment
- Extensive two-week onboarding plan
- Comprehensive mentorship program
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
