Sr. Application Security Engineer

About the Role

We are seeking a Senior Application Security Engineer to join our security team. This role will focus on ensuring the security of our applications throughout the development lifecycle, with an emphasis on modern security practices. You will work closely with development teams to implement secure coding practices and maintain our application security posture.

You Will

• Conduct security assessments using SAST, DAST, and SCA tools to identify vulnerabilities in applications
• Perform code reviews and provide secure coding guidance to development teams
• Implement and maintain GitHub Advanced Security, including secret scanning and code scanning
• Work with Engineering teams to triage and fix identified vulnerabilities
• Support CI/CD security integration and automation
• Review and secure API implementations, with focus on GraphQL security
• Maintain security documentation

You Have

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field
• 5-8 years of experience in application security or related security field
• Hands-on coding experience and ability to review code in multiple languages
• Professional experience with SAST tools (e.g., GHAS)
• Professional experience with DAST tools (e.g., Burp Suite, OWASP ZAP)
• Professional experience with SCA tools (e.g., GHAS, Black Duck, WhiteSource)
• Experience with GitHub Advanced Security features
• Strong understanding of OWASP Top 10 and secure coding practices
• Excellent communication skills to articulate security findings to technical and non-technical stakeholders

Preferred Qualifications

• Cloudflare WAF and Bot Management configuration (nice to have)
• Security automation and scripting (Python, Go, or similar)
• Contributions to the security community (research, tools, presentations)
• Experience in healthcare or regulated industries

Technical Stack

• Security Tools:, Burp Suite, GitHub Advanced Security,
• Languages: Proficiency in reviewing Python, JavaScript, Java, Go, and other modern languages
• Development skills in languages like JS, TS. Familiarity with git.
• Cloud: AWS (primary), multi-cloud experience beneficial
• CI/CD: Experience with Jenkins, GitHub Actions, or similar

What We're Looking for

• Someone who can balance security requirements with business needs
• Strong collaborator who can work effectively with development teams
• Self-motivated individual who can manage multiple security assessments simultaneously

Additional Information

This is a remote position. We are a healthcare company that adheres to NIST CSF, NIST 800-53, SOC 2, and PCI DSS compliance frameworks.

Benefits

Our Benefits (There Are More but Here Are Some Highlights):

• Competitive salary & equity compensation for full-time roles
• Unlimited PTO, company holidays, and quarterly mental health days
• Comprehensive health benefits including medical, dental & vision, and parental leave
• Employee Stock Purchase Program (ESPP)
• 401k benefits with employer matching contribution
• Offsite team retreats

We are committed to building a workforce that reflects diverse perspectives and prioritizes ethics, wellness, and a strong sense of belonging. If you're excited about this role, we encourage you to apply-even if you're not sure if your background or experience is a perfect match.

It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.

• If you need assistance or an accommodation due to a disability, please contact us at and describe the needed accommodation.
• Your privacy is important to us, and any information you share will only be used for the legitimate purpose of considering your request for accommodation.
• Please do not send resumes to this email address.