Software Engineer, Security Focus

eVisit•Mesa, AZ

15h

About The Position

We are looking for a hands-on full-stack Software Engineer focused primarily on security remediation. The first priority is owning remediation of vulnerabilities identified through penetration testing and other security assessments, from triage through a verified fix. This includes investigating the codebase, session traffic, and infrastructure to address root causes and prevent recurrence. The engineer will work closely with engineering and design teams to turn security findings into concrete, testable requirements in Technical Requirements Documents (TRDs), and personally implement or oversee fixes. The role works across a Ruby on Rails and React platform and containerized services in AWS and Fargate, including application and infrastructure layers. It also covers session management, RESTful APIs, and real-time features using Pusher and AnyCable. Clear documentation of vulnerabilities, root causes, remediation steps, and verification results is expected, as is contributing security context to FedRAMP-related discussions. As the security backlog comes under control, the engineer may contribute to application development, designing and shipping features across the Rails back end and React front end. The role participates in code reviews, testing, and technical design discussions, applying a security-minded perspective to new development and maintainable code. U.S. citizenship is required. Work is performed on U.S. federal health programs, and the candidate must be able to pass a federal background investigation and obtain a Public Trust determination.

Requirements

At least 5 years of hands-on software engineering experience, including broad full-stack work across multiple applications and technology layers.
Working proficiency in Ruby on Rails and React.
Experience with containerized environments, AWS, and Fargate.
Solid experience with APIs, including RESTful API design and security considerations.
Hands-on experience with Pusher and AnyCable or comparable real-time messaging technologies.
Knowledge of Ruby data models and how schema and query design affect performance and scalability.
At least 5 years of experience in security engineering or a closely related role.
Proven experience remediating vulnerabilities identified through penetration testing.
AWS Security certification(s), such as AWS Certified Security – Specialty.
General familiarity with FedRAMP sufficient to contribute meaningfully to a related project.
Comfort using browser developer and code inspection tools to inspect network and session traffic.
Ability to identify excessive information exposure between back end and front end and explain the risk to engineering and design stakeholders.
Ability to translate security findings into actionable design requirements for the TRD.
Solid understanding of session management principles and common pitfalls.
Strong written communication skills, including the ability to document vulnerabilities, remediations, and technical requirements for engineering and non-engineering audiences.
U.S. citizenship.
Ability to pass a federal background investigation and obtain a Public Trust determination.

Nice To Haves

Experience with Pulumi for infrastructure as code.
Python experience.
SQL skills.
Active or eligibility for a security clearance.

Responsibilities

Own end-to-end remediation of vulnerabilities identified through penetration tests and other security assessments, from triage through verified fix.
Use browser-based code inspection tools to examine front-end and back-end session traffic, identify excessive or sensitive information exposure, and translate findings into design and engineering requirements.
Feed vulnerability findings and remediation requirements into the Technical Requirements Document (TRD) process.
Review and harden session management practices across the application stack.
Implement or oversee remediation across Ruby on Rails and React codebases and containerized AWS and Fargate services, at both application and infrastructure layers.
Assess and secure real-time and API-driven features, including Pusher, AnyCable, and RESTful APIs.
Document vulnerabilities, root causes, remediation steps, and verification results.
Contribute security context and vocabulary to FedRAMP-related discussions and requirements, partnering with compliance and engineering stakeholders.
Design, build, and ship features across the Ruby on Rails back end and React front end.
Apply lessons from remediation work to new development to help prevent known classes of vulnerabilities from recurring.
Participate in code reviews, testing, and technical design discussions with attention to security and maintainability.