Staff Engineer, App Security

Healthie•,

2h•Remote

About The Position

We are hiring BOTH a Senior (and a Staff level) Application Security Engineer to join our Platform Engineering team at Healthie! In this role, you will serve as a security and technical contributor, responsible for safeguarding our application layer and driving security best practices across the engineering organization. You’ll partner closely with platform, infrastructure and core engineering teams to design secure-by-default systems, embed security into our SDLC, and proactively identify and remediate vulnerabilities in our code and cloud infrastructure. This is a hands-on role, ideal for someone who is excited to contribute to security programs in a fast-moving startup environment and help shape the future of security at Healthie. As our first dedicated AppSec hire, you’ll have the opportunity to continue to refine our secure development lifecycle, influence architectural decisions, and champion a culture of security awareness across the company. If you're passionate about building impactful systems, driving innovation, and making a difference in healthcare — we’d love to hear from you.

Requirements

5+ years of experience in application or product security roles, preferably in high-growth, cloud-native environments
Deep understanding of web application security, secure architecture patterns, and common vulnerabilities (e.g., OWASP Top 10, CIS controls, SANS Secure Coding Practices, etc.)
Strong background in secure software development practices, particularly in GraphQL, Ruby on Rails, React, or similar web frameworks
Experience with DevSecOps practices and security tooling
Experience building or maturing application-layer security programs, policies, or guidelines
Comfortable working across cross-functional teams and influencing security decisions without formal authority
You are mission-driven, passionate about healthcare, and motivated to build systems that improve patient safety and data integrity
U.S. work authorization is required and Healthie does not provide sponsorship.

Nice To Haves

Experience with healthcare-specific security practices and compliance audits (e.g., SOC 2, HIPAA)

Responsibilities

Design and implement secure coding standards and tooling for application-layer security
Conduct threat modeling and secure design reviews; manage ethical hacker program and third-party vulnerability reports
Lead regular code reviews, internal audits, and dynamic/static analysis efforts
Proficient at performing internal pentests
Contribute to the definition and design of Healthie’s secure development lifecycle (S-SDLC), including integration of security into CI/CD workflows
Administer, configure, and maintain Semgrep and other static and dynamic application security testing (SAST/DAST) tools to ensure continuous and effective code security
Partner with Engineering and Product teams to triage and remediate vulnerabilities quickly and safely
Build incident response playbooks for application-layer threats and support security investigations
Help build and promote a security champions program
Help ensure Healthie remains compliant with relevant standards (e.g., HIPAA, SOC 2, GDPR) from a software security perspective