Application Security Engineer - CI/CD & IaC Security Lead

TherapyNotes.com; Philadelphia (Philadelphia County); On-site; USD 110,000 - 150,000; Full time

Benefits offered by this job

Salary up to $150k

Insurance

Retirement plan

Profit sharing

Training budget

Open environment

Onboarding program

Mentorship program

Job summary

TherapyNotes.com is seeking an experienced Cyber Security Engineer to own application security across the SDLC and CI/CD pipeline in a HIPAA-regulated environment. You will secure GitHub Actions, perform SAST/DAST, review IaC (Terraform), and coordinate vulnerability management as part of a small security team.

Requirements include 5+ years in application security, strong knowledge of regulatory requirements (HIPAA/HITRUST/HITECH), and experience with cloud security (Azure/AWS).

Qualifications

• Bachelor's degree or equivalent experience in information security, CS, or related field.
• 5+ years in application security or security engineering.
• Proven experience securing CI/CD pipelines and GitHub Actions, including SAST/DAST and code/secret/dependency scanning.
• Experience reviewing Terraform or other IaC for security misconfigurations.
• Working knowledge of SIEM, EDR/XDR, and DLP platforms.
• Understanding of Zero Trust principles as applied to apps and identity access.
• Strong knowledge of healthcare regulations (HIPAA, HITECH, HITRUST) and their impact on security.
• Experience with API security and healthcare data standards (HL7 preferred).
• Experience securing cloud environments (Azure preferred; AWS a plus).
• Willingness to participate in on-call incident response.
• Industry certs (GWAPT, OSWE, GPEN, Azure/AWS cloud cert) are a plus.

Responsibilities

• Collaborate with developers to integrate security into the SDLC and CI/CD pipeline.
• Enforce secure coding standards to protect data confidentiality, integrity, and availability.
• Perform security assessments, code reviews, and threat modeling on applications.
• Own and operate GitHub Advanced Security, triaging findings and improving coverage and workflows.
• Secure CI/CD pipelines and GitHub Actions—manage identities, runners, permissions, and secrets.
• Review IaC for security, partnering with IT for secure deployment practices.
• Ensure measures align with HIPAA, HITRUST, and HITRUST regulations and support audits.
• Remediate vulnerabilities with actionable guidance and effective patching.
• Develop and manage security tooling (SAST, DAST, vulnerability mgmt) to automate testing.
• Support incident response activities and root-cause analysis.
• Contribute to security awareness programs for dev teams.

Skills

Application security

CI/CD security

Threat modeling

Incident response

Zero Trust

HIPAA/HITRUST

Cloud security

API security

Education

Bachelor's degree in information security, computer science, or related field

Tools

GitHub Actions

SAST/DAST

Snyk

Terraform

SIEM

EDR/XDR

DLP

Azure

AWS

Job description

TherapyNotes.com is seeking an experienced Cyber Security Engineer to own application security across the SDLC and CI/CD pipeline in a HIPAA-regulated environment. You will secure GitHub Actions, perform SAST/DAST, review IaC (Terraform), and coordinate vulnerability management as part of a small security team.

Requirements include 5+ years in application security, strong knowledge of regulatory requirements (HIPAA/HITRUST/HITECH), and experience with cloud security (Azure/AWS).