19 hours ago
Base Salary
$150k - $200k/yr
Responsibilities
- Lead application security protocol development and implementation throughout the software development lifecycle.
- Partner with engineering teams to integrate security into architecture, design, development, testing, and deployment.
- Perform hands-on security testing of web applications, APIs, cloud-native services, and supporting infrastructure.
- Build and improve automated security testing for static analysis, dependency scanning, secrets detection, container scanning, and dynamic testing.
- Evaluate application security tools, improve output quality, and reduce unnecessary findings and developer friction.
- Develop secure coding standards and developer-focused documentation.
- Contribute application security expertise to vulnerability management, security incidents and investigations, and post-incident reviews.
- Evaluate third-party applications, libraries, APIs, and integrations for security risk.
- Ensure adherence to healthcare regulatory and compliance requirements such as HIPAA and GDPR.
- Research, establish, and roll out enterprise-wide security policies and guidelines.
Requirements
- 4+ years of professional experience in application, product, or software security, or experience as a software engineer who has pivoted into security.
- Strong understanding of application security vulnerabilities and attack techniques, including OWASP Top 10 and API security risks.
- Experience performing manual security testing of modern web applications, APIs, and distributed systems.
- Ability to review application architecture and source code for security weaknesses.
- Experience integrating application security tools into modern CI/CD workflows.
- Familiarity with static application security testing, dynamic testing, secrets detection, container security, and infrastructure-as-code scanning.
- Understanding of authentication, authorization, session management, cryptography, secrets management, and secure API design.
- Strong expertise in cloud technology such as AWS, GCP, or Azure and modern programming languages.
- Understanding of the security implications of generative coding and AI code development utilities.
- Demonstrated experience researching, establishing, and successfully rolling out enterprise-wide security policies and guidelines.
- Experience with tools and technologies including Datadog, Sumo Logic, Torq, flare.io, GCP, Entitle, Okta, Orca, GitLab, and Prisma is a bonus.
Benefits
- Monthly social committees and company events.
- 18 vacation days, 9 company holidays, 5 sick days, and 2 personal days.
- Stock options for every full-time employee.
- Paid parental leave.
- 401k benefit.
- Commuter benefits.
- Competitive health, dental, and vision insurance options.
- Hybrid work arrangement is indicated by the posting.
Tech Stack
Categories
About K Health
K Health builds an AI-enabled platform for virtual and in-person primary care, delivered via a mobile app and through health-system partnerships. The company licenses its clinical AI (PatientGPT) and staffs 24/7 virtual clinics to help partners manage large patient populations and close care gaps. Founded in 2016 and headquartered in New York City, K Health’s partners include Mayo Clinic and Mass General Brigham.