Security Engineer

Ceresti Health

6d • Remote

About The Position

Ceresti is seeking a Security Engineer to help make its engineering work safe through threat modeling, risk evaluation, dependency checking, code review, and attacker-informed testing. The role bridges the CISO’s office and Engineering, working directly with developers and writing security utility tools, automation, scripts, and system integrations. The engineer will also build attack simulations using AI and existing tools, using Dev, QA, and Test environments to demonstrate real security gaps.

The primary working partner is Engineering, though the role may also build tools used by IT, including tools for Microsoft 365. The position contributes to security architecture, standards, and detection logic, and helps secure the production cloud environment, which runs on AWS via Aptible.

Ceresti is a tech-enabled dementia care provider focused on reducing avoidable hospitalizations and supporting people living with dementia and their family caregivers. Its culture emphasizes agility, innovation, collaboration, and compassionate, cost-effective care.

Requirements

• Five to seven years of experience in software or security engineering; this is not a first engineering job.
• Ability to write code comfortably, using Python, Go, or a similar language.
• Hands-on application security experience, including threat modeling, dependency and container scanning, and reviewing code for security flaws.
• Working knowledge of AWS cloud security and CI/CD pipelines, including where security fits into them.
• Offensive security fundamentals and ability to think like an attacker and build a test that proves a point.
• Ability to explain security findings to engineers in actionable terms.

Nice To Haves

• Experience with Snyk, Docker Scout, or comparable SAST, SCA, and container security tooling.
• Detection engineering experience, including writing and tuning rules for production.
• An OSCP-type certification or equivalent demonstrable offensive work.
• Experience in healthcare or another environment handling regulated data.
• Experience at a company where security was being built rather than inherited.

Responsibilities

• Build and maintain threat models for new and existing systems and features, keeping them current as architecture changes.
• Review checked-in code for security issues.
• Own Snyk and Docker Scout thresholds and findings, and drive remediation with the teams responsible.
• Review the software bill of materials for outdated or vulnerable components and drive fixes to completion.
• Review SAST and DAST results, prioritize findings, and work directly with engineers on remediation.
• Build security utility tools and automation used by Engineering and the wider company.
• Write scripts for logging, data parsing, and signal enrichment to improve security controls.
• Integrate security systems with developer tooling to make secure workflows convenient.
• Build and tune detection logic and automation used day to day by the Security Analyst.
• Build penetration tests and attack simulations using AI and existing tools, using Dev, QA, and Test environments to demonstrate exposure.
• Use results from Pentest-Tools and internal testing to inform future security work.
• Scope, coordinate, and manage the independent third-party penetration test required for SOC 2 and HITRUST, and track findings to closure.
• Contribute to security architecture, standards, and detection logic.
• Represent security in engineering initiatives involving the mobile app, tablet software, data lake, and AI and machine-learning work.
• Help secure the production cloud environment (AWS via Aptible), preferably using infrastructure as code where possible.

Benefits

• Comprehensive health, dental, and vision benefits.
• Equity participation in a growing healthcare technology company.
• PTO and a culture that respects it.
• Full-time remote work.
• Competitive base salary, with the final offer based on experience, skills, and location.
• A collaborative, mission-driven environment where the work supports family caregivers and improves outcomes for people living with dementia.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed