Staff Security Engineer
Pomelo Care3 months ago
Remote, United StatesStaff+
Base Salary
$220k - $260k/yr
Responsibilities
- Own security problems end to end by identifying priorities, building solutions, and shipping independently
- Identify meaningful risks and implement direct controls to reduce them
- Build secure-by-default libraries, guardrails, and tooling for engineering teams
- Define and implement least-privilege guardrails across services protecting sensitive patient information and health metrics
- Harden developer machines against supply-chain attacks and emerging AI-related threats
- Partner with compliance to translate control objectives into implemented controls and prioritize requirements that reduce risk and enable commercial opportunities
Requirements
- 7+ years of software engineering experience with production-grade code
- Strong security depth in threat modeling, identity and authentication flows, the OWASP Top 10, cloud security, and supply-chain security
- Experience with Kotlin, Java, Python, Go, C#, or similar programming languages
- Track record of measurably reducing organizational security risks
- Preferred experience building in healthcare and understanding HIPAA and HITRUST
- Preferred experience with Google Cloud Platform and a modern product stack
- Preferred experience building internal developer platforms or secure-by-default tooling adopted by engineers
- Preferred experience working in a fast-paced, product-oriented startup
Benefits
- Comprehensive health, dental, and vision coverage for employees and families
- High-deductible health plan with HSA options
- Flexible Spending Account (FSA)
- Equity grant participation
- 401(k) program
- Competitive vacation policy
- 16 weeks of paid parental leave
- Fully remote work flexibility within the United States
About Pomelo Care
Pomelo Care provides virtual and some in-person clinical care for women and children, spanning fertility and pregnancy through postpartum, pediatrics, perimenopause, and menopause. It partners with health plans, employers, and healthcare providers to deliver 24/7 multidisciplinary care and care navigation, using technology to identify risks early and coordinate medical, behavioral, and social support. The company is privately held and headquartered in New York, with services delivered to members through their existing benefits.