Staff Security Engineer
About The Position
Pomelo Care is the leading virtual medical practice for women and children, providing care across pregnancy, postpartum, pediatrics, menopause, and perimenopause. We combine proactive, 24/7 clinical care with technology that helps us reach patients earlier, identify risks sooner, and deliver personalized care throughout their journey. Our team includes clinicians, technologists, operators, and problem-solvers working together to make high-quality care more accessible for families nationwide. Our engineering team is the engine behind our innovative virtual care platform, building AI-powered solutions that fundamentally transform care delivery and create exceptional experiences for both patients and clinicians. If you're passionate about using technology to effect real, tangible good in the world, we'd love to meet you.
Requirements
- Strong track record of making organizations measurably safer. That track record is risks you've closed, not tickets you've opened.
- Ability to tell signal from noise, and spend time on the risks that actually move the needle.
- Builder first: 7+ years of software engineering with production-grade code under your belt (Kotlin, Java, Python, Go, C# or similar).
- Real security depth — threat modeling, identity and auth flows, the OWASP Top 10, cloud and supply-chain security.
- Instinct to understand the actual threat and build the most direct fix when something's wrong — not to go shopping for a product that claims to handle it.
- Looking for room to own more over time — and you're the type to take it, not wait for it.
Nice To Haves
- Built in healthcare and understand HIPAA and HITRUST — and how to satisfy them without drowning engineering in process.
- Experience with Google Cloud Platform and a modern product stack.
- Built internal developer platforms or secure-by-default tooling that other engineers actually adopted.
- Worked in a fast-paced, product-oriented startup.
Responsibilities
- Own security problems end to end: navigate ambiguity to decide what matters, build it, ship it independently.
- Find the real risks and build the most direct controls that take them off the table.
- Build secure-by-default libraries, guardrails, and tooling so dozens of engineers can move fast without footguns.
- Define and implement strict least-privilege guardrails across all services to safeguard sensitive patient information and health metrics.
- Harden developer machines to minimize the risk of supply chain attacks and Whatever Comes Next from AI.
- Partner with compliance to turn control objectives into real controls, and help focus effort on the requirements that genuinely reduce risk and unlock new commercial opportunities (HITRUST, health plan requirements, etc.).
Benefits
- Comprehensive Health, Dental, and Vision coverage for employees and their families
- High deductible Health Plans with Health Savings Account (HSA) options
- Flexible Spending Account (FSA)
- Equity grant participation
- 401(k) program
- Competitive vacation policy
- 16 weeks paid parental leave
- Fully remote work flexibility (within the US)
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
