Appsec Engineer Jobs

About The Position

Requirements

• 5+ years of experience in application security with hands-on experience in security assessments, penetration testing, and secure code review.
• Deep expertise in AI-native security, including advanced defense mechanisms against prompt injection, LLM production hardening, and adversarial machine learning.
• Experience securing agentic coding workflows and establishing robust guardrails for AI-generated code.
• A true "hacker" mindset with a proven track record of finding and exploiting complex vulnerabilities to build stronger defenses.
• Proficiency in utilizing modern AI assistants to accelerate your own daily workflows, including code analysis and vulnerability remediation.
• Proficiency in at least one programming language in Fabric's stack, such as Ruby, Python, or JavaScript/TypeScript.
• Experience integrating SAST and DAST tooling into CI/CD pipelines.
• Deep understanding of the OWASP Top 10, threat modeling methodologies, and common application vulnerabilities.
• Familiarity with cloud security in AWS environments and an understanding of HIPAA or other regulated industry security requirements.

Nice To Haves

• Experience securing healthcare applications or working with PHI.
• Familiarity with EHR integration security including FHIR, HL7, Epic, or Cerner APIs.
• Security certifications such as OSCP, GWEB, or BSCP.
• Experience with bug bounty program management.
• SOC 2 or HITRUST audit support experience.

Responsibilities

• Designing and implementing robust security architectures for our features, ensuring strict protections against prompt injection, adversarial machine learning, and data exfiltration.
• Establishing safe boundaries, sandboxing, and security guardrails for internal engineering teams utilizing agentic coding harnesses to write our codebase.
• Partner with engineering teams to embed security throughout the SDLC across Fabric's Ruby on Rails, Python, React, and Node.js applications. Conduct security-focused code reviews and provide actionable guidance on secure coding practices.
• Lead threat modeling exercises for new features and architectural changes. Conduct application penetration testing and vulnerability assessments across the platform, prioritizing findings and working directly with engineering to drive remediation.
• Implement and manage SAST and DAST tooling integrated into CI/CD pipelines. Build security guardrails and automated checks that allow engineering to move fast without introducing risk to the platform or patient data.
• Ensure application security practices meet HIPAA, SOC 2, and HITRUST requirements. Assess third-party integrations and APIs for security risk, including EHR integrations with Epic and Cerner.
• Run secure coding training and awareness programs for engineering teams. Serve as the internal subject matter expert on application security and lead response to application-layer security incidents.

Benefits

• MEDICAL
• DENTAL
• VISION
• UNLIMITED PTO
• 401(K) PLAN
• STOCK OPTIONS
• BONUSES