Security Engineer
Judi HealthBase Salary
$102k - $153k/yr
Responsibilities
- Design and improve cloud, platform, application, identity, network, logging, encryption, key-management, and secrets-management security controls.
- Harden Terraform infrastructure as code and cloud deployment pipelines by reviewing changes and building preventative security guardrails.
- Operate and tune CSPM/CNAPP, SIEM, vulnerability management, endpoint protection, and data protection platforms.
- Triage and drive remediation of cloud misconfigurations, vulnerabilities, and security posture findings across engineering and infrastructure teams.
- Contribute to detection engineering and incident response, including alert development, threat hunting, investigation, containment support, and root-cause documentation.
- Review application and service designs for authentication, authorization, input validation, data exposure, and secrets-handling risks.
- Assess code changes for security impact using Python and modern JavaScript frameworks and recommend practical fixes.
- Embed dependency scanning, secrets detection, container image scanning, and security gates into the software development lifecycle.
- Perform recurring infrastructure, database, web application, and container scanning and maintain remediation tracking and POA&M entries.
- Build automation for security monitoring, evidence collection, control validation, and policy enforcement.
- Author security impact analyses and support change control for authorization-boundary changes.
- Translate FedRAMP, SOC 1, SOC 2, and HITRUST requirements into auditable technical implementations with IT Audit and Compliance.
Requirements
- At least three years of hands-on experience in security engineering, cloud security, application security, or a closely related discipline.
- Demonstrated experience securing production AWS environments, including identity and access management, network controls, logging and monitoring, encryption, and cloud-native security services.
- Working proficiency in at least one modern programming or scripting language, with experience automating security tasks.
- Practical experience reading and writing Terraform and assessing infrastructure changes for security impact.
- Experience with OWASP Top 10, API security risks, and SAST, DAST, or software composition analysis platforms.
- Experience with SIEM, vulnerability management, detection and alerting, and incident investigation.
- Understanding of authentication and authorization patterns, least privilege, secrets management, OAuth2/OIDC, and enterprise SSO.
- Ability to work independently, prioritize effectively, and drive remediation across teams without formal authority.
- Strong written communication skills and ability to produce audit-ready documentation and evidence.
- Preferred: experience with FedRAMP, FISMA, StateRAMP, CMMC, or other regulated environments and control evidence management.
- Preferred: familiarity with NIST SP 800-53 Rev. 5 and FedRAMP continuous monitoring expectations.
- Preferred: policy-as-code or automated cloud compliance validation experience.
- Preferred: container and orchestration security experience with Kubernetes, ECS, or EKS.
- Preferred: healthcare or other highly regulated industry experience handling sensitive data.
- Preferred: AWS Security Specialty, CCSP, CISSP, or similar certification.
- Preferred: familiarity with AI and ML security concepts, including model access, data protection, and secure adoption practices.
Benefits
- Hybrid work arrangement requiring three days in the office, with offices in NYC, Denver, and the Charlotte, NC area.
Tech Stack
Categories
About Judi Health
Judi Health is a health technology company delivering benefit administration solutions to employers, unions, health plans, and government entities through three core offerings: - Judi Rx™: transparent, pass-through pharmacy benefit administration for self-insured employers (formerly Capital Rx) - Judi Care™: medical, dental, and vision benefit administration solutions - Judi Cloud™: enterprise licensing of the Judi® for health plans and third-party administrators (TPAs) Together, these solutions run on Judi®, our proprietary technology platform, and replace fragmented systems with Unified Claims Processing™, the industry’s first system to fully consolidate pharmacy, medical, dental, and vision benefit administration on one secure platform. We’re building the electronic infrastructure our nation needs to deliver the healthcare we deserve. To learn more, visit www.judi.health.