Information Security Development Engineer

Viva Health•Birmingham, AL

23h•Onsite

About The Position

The Information Security Development Engineer will partner closely with software engineering, infrastructure, compliance, and operations teams to integrate security, risk management, and automation throughout the software development lifecycle (SDLC). This role will help design, build, and maintain secure continuous integration/continuous delivery (CI/CD) pipelines, infrastructure as code (IaC), monitoring, threat detection, and compliance controls, especially healthcare-specific such as Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH). This individual plays a key role in proactively identifying and mitigating risks, improving our security posture, and enabling rapid, reliable delivery of software and infrastructure changes. This position will oversee and manage patching and maintaining throughout the life cycle of the software.

Requirements

Bachelor's Degree in Computer Science, Information Security, or related field; Work experience may substitute for education requirement
4+ years’ experience in DevSecOps, site reliability engineering with a security focus or similar role
Strong experience with major cloud platforms (AWS, Azure) and cloud security best practices
Proven ability to build and manage CI/CD pipelines with integrated security controls (Jenkins, GitHub Actions, GitLab CI, Azure, DevOps)
Hands-on experience with Infrastructure as Code and configuration management (Terraform, CloudFormation, ARM/Bicep)
Proficiency with security tooling including SAST/DAST, dependency and container scanning, and cloud security posture management
Solid understanding of networking, IAM, encryption, key management, and secure architecture principles
Familiarity with healthcare regulations and frameworks (HIPAA, HITECH, CMS)
Strong communication and collaboration skills across engineering, security, compliance, and business teams

Nice To Haves

CSSLP, GSSP, Security+, SSCP
Experience with Kubernetes and container security
Familiarity with SRE and resilience practices

Responsibilities

Design, implement, and maintain secure CI/CD pipelines across applications, Application Programming Interfaces (APIs), and cloud platforms.
Develop and manage infrastructure as code with security-first principles. (Terraform, CloudFormation, ARM/Bicep)
Integrate automated security testing throughout the software development lifecycle. (SAST, DAST, dependency, and container scanning)
Embed secure development practices, threat modeling, and security review gates into engineering workflows.
Monitor, detect, and respond to security vulnerabilities and incidents including remediation and root-cause analysis.
Maintain observability for systems and security events through logging, monitoring, and alerting actions.
Support regulatory compliance and contribute to audits and control implementation. (HIPAA, HITECH, CMS)
Perform risk assessments and security architecture reviews for internal systems, cloud environments, and third-party vendors.
Offer guidance, training, and promote security awareness across development and operations teams.
Stay current on evolving security threats, tool sets, frameworks, and cloud provider best practices. Recommend improvements and drive adoption.