3 hours ago
Base Salary
$165k - $200k/yr
Responsibilities
- Provide hands-on technical security guidance to software developers throughout the vulnerability remediation lifecycle.
- Perform secure code reviews, validate false positives, advise on remediation strategies, and threat model products.
- Drive vulnerability identification using SAST, DAST, SCA, and in-house AI tooling, and manage external penetration testing.
- Support vulnerability management, risk assessment, remediation improvements, and translation of security and privacy requirements into technical requirements.
- Train engineers on secure coding practices, security standards, and current security threats.
Requirements
- Have a BS in Computer Science or a related degree, or relevant certifications and equivalent experience.
- Have 5+ years of total experience, including at least one year in application security or performing security tasks in a development role.
- Have experience writing and maintaining code in at least one modern programming language and one scripting language; Heartflow uses C++ and Python.
- Have experience with secure SDLC activities such as threat modeling, code review, security testing, and vulnerability management.
- Be able to reason about security risk and communicate with technical and non-technical audiences.
- Have experience using AI coding tools such as Claude Code and GitHub Copilot for development and security testing.
- Have experience with or be able to discuss current machine-learning and generative-AI security threats.
- Healthcare knowledge including HIPAA, HITRUST, and Software as a Medical Device is helpful.
- Familiarity with AWS or equivalent cloud providers, Terraform, Chef, Ansible, Docker, Kubernetes, and GitHub Actions is helpful.
Benefits
- Hybrid work arrangement requiring three days per week in the San Francisco office.
- Base salary range of $165,000 to $200,000 per year, plus bonus and equity.
- Work on AI-powered healthcare products intended to improve patient outcomes.
About Heartflow
HeartFlow develops an AI-driven, non-invasive coronary care platform that converts coronary CT scans into 3D models and physiologic assessments (FFRct), sold to hospitals and cardiology practices. Its HeartFlow One suite (including RoadMap, FFRct, and Plaque Analysis) supports diagnosis and management of coronary artery disease and is cleared for use in the US, UK, Europe, Japan, and Canada. The company is headquartered in San Francisco and is publicly traded on Nasdaq under the ticker HTFL.