Senior Security Engineer - Application Security

The role

You will lead the development and implementation of application security protocols throughout the SDLC. You will partner with engineering teams to incorporate security into architecture, design, development, testing, and deployment.

What you will do

• Lead the development and implementation of robust application security protocols throughout the entire Software Development Lifecycle (SDLC).
• Partner with engineering teams to incorporate security into architecture, design, development, testing and deployment
• Perform hands-on security testing of web applications, APIs, cloud-native services and supporting infrastructure
• Build and improve automated security testing within CI/CI pipelines
• Evaluate effectiveness of application security tools
• Develop secure coding standards with developer-focused documentation
• Contribute application security expertise to vulnerability management, security incidents/investigations and post-incident reviews
• Evaluate third party applications, libraries and APIs and integrations for security risk
• Ensure adherence to relevant healthcare regulatory and compliance requirements (e.g., HIPAA, GDPR, etc.)

Required qualifications

• 4+ years of professional experience in application, product or software security, operating as an individual contributor, OR as a software engineer that has pivoted into security
• Strong understanding of application security vulnerabilities and attach techniques, including OWASP Top 10 and API security risks
• Experience performing manual security testing of modern web applications, APIs and distributed systems
• Ability to review application architecture and source code for security weaknesses
• Experience integrating application security tools into modern CI/CD workflows
• Familiarity with static application security testing, dynamic testing, secrets detection, container security and infrastructure-as-code scanning
• Understanding of authentication, authorization, session management, cryptography, secrets management and secure API design
• Strong expertise in cloud technology (AWS, GCP, or Azure), modern programming languages, utilization of generative coding utilities, and the security implications of utilizing AI code development util
• Demonstrated experience researching, establishing, and successfully rolling out enterprise-wide security policies and guidelines

Nice to have

• Exploring, partnering and implementing bleeding edge tech not readily available to others
• Experience with specific tools and tech K uses including but not limited to: Datadog, Sumologic, Torq, flare.io , GCP, Entitle, Okta, Orca, GitLab, Prisma Access Browser

About the company

K Health uses an AI-powered virtual care engine to modernize the primary care loop. The company was founded in 2016 and is headquartered in New York City.