Senior Application Security Engineer II
Spring HealthBase Salary
$180k - $206k/yr
Responsibilities
- Advance secure-by-design practices through architecture reviews, design consultations, and security guidance across the software development lifecycle.
- Mentor engineers on secure coding, application security fundamentals, and career growth.
- Develop an AI-assisted threat modeling program covering risk identification, security architecture, tooling, methodology, and organizational adoption.
- Mature SAST, SCA, and DAST programs through rule tuning, noise reduction, coverage improvements, and stronger security controls.
- Perform security-focused code reviews of internal and open-source libraries and prioritize findings by exploitability and business impact.
- Support vulnerability remediation by assessing impact, proposing solutions, and validating fixes.
- Implement security automation and AI tooling integrations using Go, Python, JavaScript, or Ruby.
- Assess AI-integrated product features, including LLM APIs, vector databases, and RAG pipelines, for prompt injection, data leakage, and model supply-chain risks.
- Research, design, and develop a Secure AI Development Lifecycle aligned with the OWASP Top 10 for LLM Applications and emerging adversarial ML guidance.
- Evaluate and recommend AI-assisted security tools such as AI-augmented SAST and LLM-powered code review.
Requirements
- At least 7 years of professional experience in application security or a closely related security engineering discipline.
- Hands-on experience with DAST, SAST, SCA tools, and manual testing techniques based on OWASP and the SANS Top 25.
- Experience securing CI/CD pipelines with commercial and custom-built tooling.
- Experience with IaaS cloud infrastructure such as AWS, Azure, or GCP, as well as container technologies and service-oriented architectures.
- Security automation experience with at least one of Go, Python, JavaScript, or Ruby.
- Familiarity with AI/ML security concepts including prompt injection, adversarial inputs, model supply-chain risks, and the OWASP LLM Top 10.
- Working knowledge of AI and LLM tooling such as OpenAI, Anthropic, or LangChain for security assessment and workflow integration.
- Experience implementing controls aligned to NIST CSF, HIPAA, HITRUST, ISO-27001, or SOC-2.
- Bachelor’s degree in Computer Science, Engineering, MIS, or IT, or equivalent work experience.
- Strong cross-functional collaboration experience with engineering, product, and leadership stakeholders.
- Preferred: at least 3 years of security architecture experience.
- Preferred: experience developing formal threat modeling programs, evaluating AI security tooling, managing bug bounty or vulnerability disclosure programs, or working in digital health or HIPAA-regulated environments.
Benefits
- Full-time, fully remote position for candidates residing within the United States, with occasional travel to the New York City headquarters possibly required.
- Health, dental, and vision benefits begin on the first day; One Medical access and HSA/FSA plans are available, with employer HSA contributions up to $1,000 depending on plan type.
- Employer-sponsored 401(k) match of up to 2%.
- Yearly allotment of no-cost visits to Spring Health therapists, coaches, and medication management providers for employees and dependents.
- Paid vacation, sick leave, and company holidays.
- After six months of tenure, parental leave is 18 weeks for birthing parents and 16 weeks for non-birthing parents.
- Access to Noom, Carrot fertility care support with up to $4,000 reimbursement, Wellhub, and BrightHorizons sponsored care services.
- Up to $1,000 per year in professional development reimbursement.
- Up to $200 per year in donation matching.
Tech Stack
Categories
About Spring Health
At Spring Health™, we help employers modernize their behavioral health benefits with the most effective, comprehensive solution for employee mental wellbeing. Our offering functions as a single front door to any type of care - from digital exercises, to EAP services, to coaching, therapy, or medication. We use a proprietary assessment and machine-learning technology to understand all of the conditions a person may be experiencing, and use those results to match them to a care plan personalized to their needs. Each member has access to a Care Navigator to help guide them through their options, assist in booking appointments with therapists, and connect them to domain experts across work-life, legal, or financial services. This innovative, personalized approach to care, paired with a seamless, high-touch member experience makes Spring Health™ the most holistic, effective behavioral health benefit for modern, people-first employers. Suicidal crisis or emotional distress – For immediate help for you or someone else, call 1-800-273-8255. Available 24/7.