Software Engineer, Security Focus

eVisit•Mesa, AZ

15h

About The Position

This is a hands-on, full-stack engineering role focused primarily on remediating security vulnerabilities identified through penetration testing and other assessments. The engineer will investigate vulnerabilities across code, session traffic, and infrastructure; implement or oversee fixes; and verify that remediation is effective and prevents recurrence. They will work with engineering and design teams to turn findings into concrete, testable requirements in Technical Requirements Documents (TRDs). The role works across a Ruby on Rails and React platform and containerized services on AWS and Fargate. It includes reviewing session management, APIs, and real-time features built with technologies such as Pusher and AnyCable, as well as documenting vulnerabilities, root causes, remediation steps, and verification results. The engineer will contribute security context to FedRAMP-related discussions and, as the security backlog comes under control, may also build application features with a security-minded perspective. Work is performed on U.S. federal health programs.

Requirements

At least 5 years of hands-on software engineering experience, including broad full-stack work across multiple applications and technology layers.
Working proficiency in Ruby on Rails and React.
Experience with containerized environments, AWS, and Fargate.
Solid experience with RESTful API design and security considerations.
Hands-on experience with Pusher and AnyCable, or comparable real-time messaging technologies.
Knowledge of Ruby data models and how schema and query design affect performance and scalability.
At least 5 years of experience in security engineering or a closely related role.
Proven experience remediating vulnerabilities identified through penetration testing.
AWS Security certification(s), such as AWS Certified Security – Specialty.
General familiarity with FedRAMP sufficient to contribute to a FedRAMP-related project.
Comfort using browser developer/code inspection tools to inspect network and session traffic.
Ability to identify excessive information exposure between back end and front end and clearly explain the risk to engineering and design stakeholders.
Ability to translate security findings into actionable design requirements for TRDs.
Solid understanding of session management principles and common pitfalls.
Strong written communication skills for documenting vulnerabilities, remediations, and technical requirements for engineering and non-engineering audiences.
U.S. citizenship.
Ability to pass a federal background investigation and obtain a Public Trust determination.

Nice To Haves

Experience with Pulumi for infrastructure as code.
Python experience.
SQL skills.
Active or eligible for security clearance.

Responsibilities

Own vulnerability remediation from triage through verified fix, including findings from penetration tests and other security assessments.
Inspect browser network and session traffic to identify excessive or sensitive information exposed between the front end and back end, and translate findings into engineering and design requirements.
Feed vulnerability findings and remediation requirements into the Technical Requirements Document process.
Review and harden session management practices across the application stack.
Implement fixes across the Ruby on Rails and React application and containerized AWS/Fargate services, including at application and infrastructure layers.
Assess and secure real-time and API-driven features, including Pusher, AnyCable, and RESTful APIs.
Document vulnerabilities, root causes, remediation steps, and verification results.
Contribute security context and vocabulary to FedRAMP-related discussions and requirements with compliance and engineering stakeholders.
Design, build, and ship features across the Ruby on Rails back end and React front end.
Apply remediation learnings to new development to help prevent known vulnerability classes from recurring.
Participate in code reviews, testing, and technical design discussions with attention to security and maintainability.