Application Security Engineer
Strive Health7 days ago
USA (city not specified)Mid Level / Senior
Base Salary
$109k - $136k/yr
Responsibilities
- Perform threat modeling and establish security baselines for internal environments, patient portals, mobile applications, and integration services.
- Maintain data-flow and trust-boundary diagrams and assess identity, operational, and PHI data classifications.
- Embed security acceptance criteria into product requirements, technical plans, and Jira stories.
- Conduct architecture reviews focused on tenant boundaries, server-side authorization, IDOR prevention, and lateral movement guardrails.
- Develop and enforce merge request checklists for authentication, input validation, secrets management, and cryptography.
- Design, deploy, and operate SAST, DAST, software composition analysis, container, and infrastructure-as-code scanning tools.
- Perform authenticated testing of browser workflows and APIs and manually test vulnerabilities such as privilege escalation, SSRF, and business-logic abuse.
- Manage vulnerability intake, severity assignment, remediation tracking, and recurring reviews with Security, Product, and Engineering.
- Coordinate external penetration tests, including scoping, vendor selection, remediation tracking, and retesting.
- Maintain security requirements, threat models, testing evidence, and remediation documentation for compliance and audit readiness.
Requirements
- Bachelor’s degree in Computer Science, Information Security, or a related field.
- 3+ years of information security experience for the Engineer level or 5+ years for the Senior level, with a focus on Application Security, DevSecOps, or software engineering.
- Demonstrable experience integrating application security tools into development pipelines, including SAST, DAST, and SCA.
- Experience leading or performing application threat modeling, architecture reviews, and manual security testing.
- Familiarity with securing SaaS, IaaS, and PaaS environments and understanding cloud architecture.
- Ability to travel and work onsite as needed, with specified internet connectivity of at least 3.8 Mbps download and 3.0 Mbps upload and latency below 60 ms.
- Preferred healthcare experience involving PHI and frameworks such as HITRUST.
- Preferred expertise with OWASP Top 10, IDOR, SSRF, authentication bypass, complex API integrations, mobile application releases, and web portals.
- Preferred familiarity with Burp Suite Enterprise and automated security testing against deployed applications.
- Advanced application security or information security certifications such as CSSLP, GWAPT, CISSP, or CEH are preferred.
- Strong problem-solving, analytical, communication, collaboration, and stakeholder-communication skills are required.
Benefits
- Hybrid-remote flexibility with work from home and in-person needs at an office, clinic, or patient home visits.
- Medical, dental, and vision insurance, employee assistance programs, life and disability insurance, and health and flexible spending accounts.
- Performance-based bonus program, 401(k) with employer match, and financial wellness resources.
- Paid holidays, vacation and sick time, and paid birthgiving, bonding, sabbatical, and living donor leaves.
- Family-forming services through Maven Maternity, physical wellness perks, mental health support, and an annual professional development stipend.
Categories
About Strive Health
Strive Health delivers value-based kidney care, integrating a technology platform with local provider networks to manage patients from chronic kidney disease through end-stage kidney disease. It partners with commercial and Medicare Advantage payors, Medicare, health systems and physicians through value-based, often risk-based, contracts; founded in 2018 and headquartered in Denver, the privately held company’s case management programs are NCQA-accredited and its CareMultiplier platform is HITRUST-certified, serving 145,000+ patients across all 50 states with 6,500+ provider partners.