Security Engineer

We are seeking a hands-on Security Engineer embedded within our engineering organization. In this role, you will be the primary technical authority securing our AWS cloud architecture, modern CI/CD pipelines, and web/connected applications. You will bridge software engineering, DevOps, and security—shifting security left into our build pipelines and ensuring our cloud posture remains audit-ready for SOC 2 and healthcare compliance standards.This is an engineering role, not an IT or corporate security role. The ideal candidate writes code, manages AWS infrastructure controls, integrates automated tooling into Jenkins and GitHub Actions CI/CD workflows, and partners directly with software engineers across the entire Software Development Life Cycle (SDLC).

• Embed automated security gates into developer workflows and CI/CD pipelines (Jenkins, GitHub Actions, or GitLab CI) using SAST, DAST, and SCA scanning.
• Own Software Composition Analysis (SCA) to identify vulnerable dependencies, manage container image scanning, and secure build artifacts against software supply chain risks.
• Build automation scripts (Python, Bash) to automate vulnerability triage, evidence gathering, and security remediation workflows across build environments.

• Review application code, cloud architectures, and pull requests to identify OWASP Top 10 vulnerabilities, auth flaws, and logic bugs early in development.
• Scope and manage external penetration tests and bug bounty programs; validate findings and partner directly with engineering squads to write and verify technical remediation fixes.
• Secure APIs and backend endpoints interfacing with connected medical devices and client applications.

• Serve as the primary technical interface for SOC 2 Type II and HIPAA audits, partnering with DevOps to maintain technical security controls and automated evidence collection.
• Leverage continuous compliance and posture management platforms (e.g., Vanta) to ensure production cloud infrastructure continuously meets audit baselines without manual overhead.

• Investigate security alerts generated from AWS GuardDuty, Inspector, and production infrastructure logs.
• Lead root-cause analysis (RCA) for application-level and cloud-level security events and build automated prevention mechanisms so the same class of incident cannot recur.

• Experience with Infrastructure as Code (IaC) and static analysis tools (e.g., Terraform).
• Familiarity with additional programming languages used by our engineering team (Python, Javascript).
• Experience with IoT or connected device ecosystems (device provisioning, mutual TLS, secure key rotation, and OTA update pipelines).
• Relevant industry certifications (e.g., AWS Certified Security – Specialty, AWS Solutions Architect, OSCP, or equivalent practical certifications).

• 3+ years of hands-on experience in Cloud Security, Application Security (AppSec), or DevSecOps within a production cloud-native engineering environment.
• Deep AWS Security Expertise: Hands-on experience configuring and operating AWS native security services (GuardDuty, Inspector, Security Hub, AWS Config, IAM policies, and VPC security).
• CI/CD Security Automation: Proven background integrating automated security checks (SAST, SCA, container scanning) into build pipelines using Jenkins and modern CI systems (e.g., GitHub Actions, GitLab CI).
• Compliance in Cloud Environments: Direct experience implementing, maintaining, and gathering automated evidence for technical controls in SOC 2 Type II audits (familiarity with platforms like Vanta is a major plus).
• Application Security Fundamentals: Strong understanding of OWASP Top 10, CWE, secure authentication/authorization, and modern API security patterns.
• Scripting & Automation: Proficiency in Python or Shell scripting (Bash) to automate security tooling, query APIs, and parse logs.