Security Engineer

Cala Health

2d•$155,000 - $190,000•Remote

About The Position

Cala is seeking a hands-on Security Engineer embedded within its engineering organization. The role is the primary technical authority for securing AWS cloud architecture, CI/CD pipelines, and web and connected applications. It bridges software engineering, DevOps, and security by integrating security into build pipelines and maintaining an audit-ready cloud posture for SOC 2 and healthcare compliance standards. This is an engineering role involving code, AWS infrastructure controls, automated tooling, and collaboration with software engineers throughout the Software Development Life Cycle (SDLC). The position is remote, with a hybrid option for candidates local to San Mateo, California. It is full-time and exempt, with a listed pay range of $155,000–$190,000. Final compensation depends on experience, skills, market benchmarks, internal equity, and potentially candidate location.

Requirements

At least 3 years of hands-on experience in Cloud Security, Application Security (AppSec), or DevSecOps in a production cloud-native engineering environment.
Hands-on experience configuring and operating AWS security services, including GuardDuty, Inspector, Security Hub, AWS Config, IAM policies, and VPC security.
Experience integrating automated security checks, including SAST, SCA, and container scanning, into build pipelines using Jenkins and modern CI systems such as GitHub Actions or GitLab CI.
Direct experience implementing, maintaining, and gathering automated evidence for technical controls in SOC 2 Type II audits.
Strong understanding of OWASP Top 10, CWE, secure authentication and authorization, and modern API security patterns.
Proficiency in Python or Shell scripting (Bash) to automate security tooling, query APIs, and parse logs.
Authorization to work in the United States on a full-time basis, or eligibility for a work authorization sponsorship path supported by Cala Health; sponsorship is assessed individually and is not guaranteed.

Nice To Haves

Experience with Infrastructure as Code (IaC) and static analysis tools such as Terraform.
Familiarity with additional programming languages used by the engineering team, including Python and JavaScript.
Experience with IoT or connected device ecosystems, including device provisioning, mutual TLS, secure key rotation, and OTA update pipelines.
Relevant industry certifications, such as AWS Certified Security – Specialty, AWS Solutions Architect, OSCP, or equivalent practical certifications.
Familiarity with compliance platforms such as Vanta.

Responsibilities

Architect, implement, and monitor AWS security controls using services such as GuardDuty, Inspector, Security Hub, IAM Access Analyzer, KMS, and CloudTrail.
Define and enforce least-privilege IAM policies, VPC network isolation, and encryption in transit and at rest.
Use Infrastructure as Code security tooling to identify and prevent cloud misconfigurations before deployment.
Integrate automated SAST, DAST, and SCA security gates into developer workflows and CI/CD pipelines, including Jenkins, GitHub Actions, or GitLab CI.
Manage software composition analysis, vulnerable dependency identification, container image scanning, and protection of build artifacts against software supply chain risks.
Write Python or Bash automation for vulnerability triage, evidence gathering, and security remediation workflows.
Review application code, cloud architectures, and pull requests for OWASP Top 10 vulnerabilities, authentication flaws, and logic bugs.
Scope and manage external penetration tests and bug bounty programs, validate findings, and partner with engineering teams on technical remediation.
Secure APIs and backend endpoints that interface with connected medical devices and client applications.
Serve as the primary technical interface for SOC 2 Type II and HIPAA audits, maintaining technical controls and automated evidence collection with DevOps.
Use continuous compliance and posture management platforms such as Vanta to maintain cloud infrastructure against audit baselines.
Investigate security alerts from AWS GuardDuty, Inspector, and production infrastructure logs.
Lead root-cause analysis of application- and cloud-level security events and develop automated prevention mechanisms.