Security Engineer
Cala Health6 days ago
Remote, United States or San Mateo, CA, USAMid Level
Base Salary
$155k - $190k/yr
Responsibilities
- Architect, implement, and monitor AWS cloud security controls using GuardDuty, Inspector, Security Hub, IAM Access Analyzer, KMS, CloudTrail, AWS Config, and VPC security controls.
- Define least-privilege IAM policies, network isolation, and encryption controls, and use Infrastructure as Code security tooling to prevent cloud misconfigurations.
- Integrate SAST, DAST, SCA, container scanning, and other automated security gates into Jenkins, GitHub Actions, or GitLab CI pipelines.
- Automate vulnerability triage, evidence collection, remediation workflows, and software supply-chain protections using Python and Bash.
- Review application code, cloud architectures, and pull requests for OWASP Top 10 vulnerabilities, authentication flaws, and logic bugs.
- Manage external penetration tests and bug bounty programs, validate findings, and partner with engineering teams on remediation.
- Secure APIs and backend endpoints supporting connected medical devices and client applications.
- Maintain technical controls and automated evidence collection for SOC 2 Type II and HIPAA audits, including use of Vanta.
- Investigate security alerts, lead root-cause analysis for application and cloud security incidents, and build automated prevention mechanisms.
Requirements
- At least 3 years of hands-on experience in Cloud Security, Application Security, or DevSecOps in a production cloud-native engineering environment.
- Hands-on experience configuring and operating AWS security services including GuardDuty, Inspector, Security Hub, AWS Config, IAM policies, and VPC security.
- Experience integrating SAST, SCA, and container-scanning checks into Jenkins and modern CI systems such as GitHub Actions or GitLab CI.
- Direct experience implementing technical controls and gathering automated evidence for SOC 2 Type II audits; Vanta familiarity is preferred.
- Strong understanding of OWASP Top 10, CWE, secure authentication and authorization, and modern API security patterns.
- Proficiency in Python or Bash/Shell scripting for automating security tooling, querying APIs, and parsing logs.
- Experience with Infrastructure as Code and static-analysis tools such as Terraform is preferred.
- Familiarity with Python and JavaScript is preferred.
- Experience with IoT or connected-device ecosystems, including device provisioning, mutual TLS, secure key rotation, and OTA update pipelines, is preferred.
- Relevant certifications such as AWS Certified Security – Specialty, AWS Solutions Architect, OSCP, or equivalent practical certifications are preferred.
Benefits
- Full-time, exempt employment with a remote work arrangement; hybrid work is available for candidates local to San Mateo, California.
- Employees receive tools, training, and mentoring.
- Base pay range is $155,000–$190,000, with final compensation based on experience, skills, market benchmarks, internal equity, and location.
Tech Stack
Categories
About Cala Health
Cala Health develops non-invasive, prescription wearable neuromodulation devices for people with essential tremor; its Cala kIQ wrist-worn therapy delivers individualized peripheral nerve stimulation. The company sells regulated medical devices through clinicians to patients, with additional programs in neurology, cardiology, and psychiatry in development. Founded in 2014 and headquartered in San Mateo, California, Cala Health is privately held.