Cybersecurity Engineer

Sphere Technology; Manila; Remote; PHP 1,200,000 - 1,800,000; Full time

Job summary

Sphere Technology is hiring its first dedicated Cybersecurity Engineer to own the full security posture of a growing telehealth platform and EHR system handling PHI. This senior, hands-on role builds a security foundation across engineering culture, CI/CD pipelines, and GCP-native cloud infrastructure to keep us defensible as we scale across healthcare verticals.

You will be Sphere's first security hire, reporting to engineering leadership and partnering with product and backend teams daily.

Qualifications

• 5+ years of experience in application security or security engineering.
• Hands-on experience with DevSecOps tooling (Snyk, Trivy, Semgrep, GitHub Advanced Security, HashiCorp Vault, OWASP ZAP).
• Strong GCP security fundamentals (Security Command Center, Cloud Armor, Chronicle SIEM, VPC Service Controls, IAM, Cloud Logging).
• Direct experience with HIPAA, HITECH, or comparable regulated environments (SOC 2, PCI-DSS, ISO 27001 a plus).
• Proficiency in at least one scripting/automation language (Python, Bash, or similar).
• Solid understanding of web application security (OWASP Top 10, API security, auth/authz patterns).
• Ability to work independently and cross-functionally - sole security voice for 12-18 months.
• Excellent written communication - document policies, explain risk to non-technical stakeholders.

Responsibilities

• Own Application & Cloud Security across web apps, APIs, and GCP infrastructure; implement security controls across environments and healthcare verticals.
• Integrate security gates into CI/CD pipelines: SAST/DAST, dependency scanning, secrets detection, container image scanning, secure coding standards.
• Maintain HIPAA/HITECH compliance posture with technical safeguards, access controls, audit logging, encryption standards, and BAA oversight.
• Run vulnerability assessments, manage risk register, triage findings, drive remediation with engineering.
• Own the Incident Response plan; lead detection, containment, and post-mortem for incidents.
• Document security policies and architecture decisions for smooth handoff to a future CISO.
• Be the go-to security resource for engineering and product to make PHI protection a default.

Job description

We're hiring ourfirst dedicated Cybersecurity Engineerto own the full security posture of a growing multi-vertical telehealth platform and EHR system handling Protected Health Information (PHI). This is asenior, hands-on build-and-maintain role- not a compliance checkbox or one-time audit. You'll embed security across our engineering culture, CI/CD pipeline, and GCP (Google Cloud Platform)-native cloud infrastructure, and keep us defensible as we scale across multiple healthcare verticals.

You'll serve as Sphere'sfirst security hire, building the foundation ahead of a CISO (Chief Information Security Officer) joining in 2027. Everything you build should be documented, scalable, and transferable. You'll report directly to engineering leadership and partner closely with product and backend engineers daily.

Schedule: 9 AM to 6 PM EST

What You'll Own

• Application & Cloud Security- Continuously assess and harden web apps, APIs, and GCP-native infrastructure; implement security controls across all environments and healthcare verticals
• DevSecOps & Secure SDLC- Integrate security gates into the CI/CD pipeline: SAST/DAST, dependency scanning, secrets detection, container image scanning, and secure coding standards
• HIPAA/HITECH Compliance- Maintain and improve our compliance posture including technical safeguards, access controls, audit logging, encryption standards, and BAA oversight; lay groundwork for HITRUST CSF certification
• Vulnerability & Threat Management- Run ongoing vulnerability assessments, manage a risk register, triage findings, and drive remediation with engineering
• Incident Response- Own the IR plan; lead detection, containment, and post-mortem for security incidents
• Security Foundation Building- Document all security policies, controls, and architecture decisions to enable a smooth handoff to an incoming CISO in 2027
• Security Culture- Be the go-to security resource for engineering and product - make PHI protection a default, not an afterthought

You're a Strong Fit If You Have

• 5+ yearsof experience in application security, cloud security, or security engineering
• Hands-on experience withDevSecOps tooling(e.g., Snyk, Trivy, Semgrep, GitHub Advanced Security, HashiCorp Vault, OWASP ZAP)
• StrongGCP securityfundamentals - GCP Security Command Center, Cloud Armor, Chronicle SIEM, VPC Service Controls, IAM, and Cloud Logging
• Direct experience withHIPAA, HITECH, or comparable regulated environments (SOC 2, PCI-DSS, ISO 27001 a plus)
• Proficiency in at least one scripting/automation language (Python, Bash, or similar)
• Solid understanding of web application security (OWASP Top 10, API security, auth/authz patterns)
• Ability to workindependently and cross-functionally- you'll be the sole security voice for 12-18 months
• Excellent written communication - able to document policies, explain risk to non-technical stakeholders, and write clear incident reports
• Comfortable working withmeaningful overlap with US Eastern or Pacific hours

Nice to Have

• Security certifications:CISSP, CISM, CEH, Security+, GCP Professional Cloud Security Engineer, or equivalent
• Familiarity withHITRUST CSFframework
• Experience inhealthcare tech, telehealth, or multi-vertical health platforms
• Familiarity withFHIR/HL7data standards and EHR security considerations
• Experience conducting or managing third-partypenetration tests
• Exposure toZero Trust architectureor SASE frameworks