Senior Application Security Engineer

The role

This person will own application-layer security across the platform. They will build and tune a code scanning program and work with engineering teams on design, architecture, and services.

What you will do

• Build and run application security scanning program
• Triage findings from scans, penetration tests, and bug bounty reports
• Partner with engineering teams to fix vulnerabilities
• Build trust and cooperation with engineering, product, and design teams
• Perform threat modeling and maintain secure-coding standards
• Support incident response for application-layer security issues
• Coordinate and help manage third-party penetration tests
• Track and report on security posture metrics

Required qualifications

• 5+ years of experience in application security, security engineering, or a related software engineering role with a security focus
• Hands-on experience with SAST, DAST, and dependency/SCA scanning tools
• Deep understanding of common vulnerability classes (OWASP Top 10, authentication/authorization flaws, injection, SSRF, etc.)
• Experience with cloud environments
• Experience securing modern CI/CD pipelines
• Strong communication skills

Nice to have

• AWS preferred
• Experience in healthcare, fintech, or another regulated industry
• Experience working within compliance frameworks such as HIPAA, SOC 2, or GDPR
• Security certifications such as OSCP, GWAPT, or CSSLP
• Experience building or maturing an AppSec program from an early stage
• Scripting or automation experience (Python, Go, Terraform, or infrastructure-as-code tool like Terraform)
• Red team experience performing internal campaigns and providing remediation reports

Benefits

• Competitive pay with equity options
• Stellar health care plan options (Medical, Dental & Vision), with FSA, DCFSA, & HSA options
• Company-sponsored disability & life insurance
• Unlimited PTO
• 401(k) + 4% Matching
• $750 work-from-home setup budget
• Paid biannual in-person company summits
• Quarterly $150 co-hanging stipend to meet up with coworkers
• Monthly $100 health and wellness benefit
• Generous paid family leave
• Annual $1,200 learning & development stipend

Before you apply

• Requires current authorization to work in the United States
• Turquoise does not sponsor employment visas (H-1B, PERM, etc.) or assume sponsorship of existing visas

About the company

Turquoise Health is a Series C price transparency platform for finance leaders across healthcare. They are a remote-first, US-based team.