Cyber Security Engineer (Application Security)

What you’ll do

• Partner with development teams to embed security continuously throughout the SDLC and CI/CD pipeline.
• Set and enforce secure coding standards and best practices to reduce vulnerabilities and protect the confidentiality, integrity, and availability of customer data.
• Conduct in-depth security assessments, code reviews, and threat modeling to identify application vulnerabilities and risks.
• Own and operate GitHub Advanced Security: triage code, secret, and dependency-scanning findings, identify recurring vulnerability patterns, and recommend fixes. Improve scanning coverage, configuration, and workflows over time.
• Secure CI/CD pipelines and GitHub Actions by tightening identities, runners, permissions, and secrets, while reducing software supply chain risk through third-party action review, dependency controls, action pinning, and artifact provenance.
• Review Terraform and other infrastructure-as-code for security issues and collaborate with IT platform teams on IaC scanning and secure deployment practices.
• Ensure application security aligns with healthcare regulations and standards, including HIPAA, HITRUST, and HITECH, and supports regular audits.
• Collaborate with developers to remediate vulnerabilities by providing actionable guidance and ensuring effective patching or mitigation.
• Develop, deploy, and manage security tools such as SAST, DAST, and vulnerability management systems to automate security testing and scanning.
• Support application security incident response, including identifying root causes and contributing to resolution strategies.
• Contribute to security awareness efforts focused on secure coding practices and proactive security measures for development teams.

What you bring

• 5+ years in application security or security engineering.
• A Bachelor’s degree in information security, computer science, or related field preferred (equivalent experience considered).
• Proven experience securing CI/CD pipelines and GitHub Actions, including SAST/DAST, code/secret/dependency scanning triage (for example, GitHub Advanced Security, Snyk), runner and workflow-permission security, and third-party action or supply chain risk.
• Experience reviewing Terraform or other infrastructure-as-code for security misconfigurations.
• Working knowledge of SIEM, EDR/XDR, and DLP platforms, including deployment, tuning, and alert triage.
• Understanding of Zero Trust architecture principles as they apply to application and identity access.
• Strong understanding of healthcare regulations (HIPAA, HITRUST, HITECH) and their impact on application security.
• Experience with API security, especially integrations with other healthcare systems. Familiarity with HL7 or other healthcare data standards is preferred.
• Experience securing cloud environments (Azure preferred, AWS a plus).
• Willingness to participate in an incident response on-call rotation.
• Industry certifications such as GWAPT, OSWE, GPEN, or a cloud security certification (Azure/AWS) are ideal. CISSP or HCISPP is a plus but not a substitute for hands-on tooling experience.

Benefits

• Competitive salary - $110,000-$130,000
• Employer sponsored health, dental, vision, life, and disability insurance
• Retirement plan with company contribution
• Annual company profit sharing
• Personal development/training budget
• Open, collaborative work environment
• Extensive 2-week onboarding plan
• Comprehensive mentorship program

Technologies you’ll work with

• GitHub Actions, GitHub Advanced Security, Snyk
• SAST, DAST
• Terraform
• SIEM, EDR/XDR, DLP
• Zero Trust
• Azure, AWS
• HL7
• GWAPT, OSWE, GPEN, CISSP, HCISPP

How this team works

This hands-on role focuses on application security across the SDLC and CI/CD pipeline, with additional contributions to broader security engineering such as vulnerability management, incident response, and identity and access security. TherapyNotes is looking for someone who values continuous learning, takes ownership of projects, and collaborates effectively with cross-functional teams.