Application Security Engineer: CI/CD, GitHub & Secure IaC

Cybersecurity Jobs; Philadelphia (Philadelphia County); On-site; USD 110,000 - 150,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Life insurance

Disability insurance

Retirement plan with company match

Profit sharing

Training budget

Mentorship program

Onboarding program

Job summary

TherapyNotes.com is seeking a hands-on Cyber Security Engineer to drive application security across the SDLC and CI/CD, with emphasis on GitHub Actions security and vulnerability management. The role involves securing CI/CD pipelines, triaging code and dependency findings, and enforcing secure coding standards to protect patient data.

You will review IaC, including Terraform, and collaborate with IT and development teams to ensure secure deployment practices while maintaining

Qualifications

• BS in information security or CS; equivalent experience considered.
• 5+ years in application security or security engineering.
• Proven experience securing CI/CD pipelines and GitHub Actions.
• Experience reviewing Terraform for security misconfigurations.
• Knowledge of SIEM, EDR/XDR, and DLP platforms.
• Understanding of Zero Trust architecture in app security.
• Healthcare regulations like HIPAA/HITRUST/HITECH knowledge.
• Experience with API security and HL7 data standards.
• Cloud security in Azure (AWS a plus).
• Willingness for on-call incident response.
• Industry certs such as GWAPT, OSWE, GPEN, or Azure/AWS cloud security certs; CISSP/HCISPP a plus.

Responsibilities

• Collaborate with development teams to embed security into SDLC and CI/CD.
• Enforce secure coding standards to reduce vulnerabilities and protect data.
• Conduct in-depth security assessments, code reviews, and threat modeling.
• Own and operate GitHub Advanced Security; triage findings and improve scanning.
• Secure CI/CD pipelines by addressing identities, runners, permissions, secrets.
• Review IaC (Terraform) for security issues with IT platform teams.
• Ensure security measures align with HIPAA, HITRUST, HITECH and audits.
• Partner with developers on vulnerability remediation with actionable guidance.
• Develop and manage security tooling (SAST/DAST, vulnerability mgmt).
• Support security incident response and root-cause analysis.
• Contribute to security awareness programs for dev teams.

Skills

CI/CD security

GitHub Actions

SAST/DAST

Vulnerability management

Incident response

Identity & access security

Healthcare regulations knowledge

Education

Bachelor's degree or equivalent experience

Tools

GitHub Advanced Security

Snyk

Terraform

SIEM

EDR/XDR

DLP

Job description

TherapyNotes.com is seeking a hands-on Cyber Security Engineer to drive application security across the SDLC and CI/CD, with emphasis on GitHub Actions security and vulnerability management. The role involves securing CI/CD pipelines, triaging code and dependency findings, and enforcing secure coding standards to protect patient data.

You will review IaC, including Terraform, and collaborate with IT and development teams to ensure secure deployment practices while maintaining