Application Security Engineer - SDLC & CI/CD Expert

TherapyNotes, LLC; Philadelphia (Philadelphia County); On-site; USD 110,000 - 150,000; Full time

Benefits offered by this job

Competitive salary

Health insurance

Retirement plan with company contrib.

Annual profit sharing

Professional development budget

Open, collaborative work environment

2-week onboarding plan

Mentorship program

Job summary

TherapyNotes LLC is seeking an experienced Cyber Security Engineer to own application security across the SDLC and CI/CD pipelines in a healthcare‑regulated environment. You’ll secure CI/CD, code scanning, and IaC, while contributing to incident response and vulnerability management with a small security team.

The ideal candidate has 5+ years in security engineering, strong knowledge of HIPAA/HITRUST, and hands‑on tooling like SAST/DAST, Snyk, and GitHub Advanced Security.

Qualifications

• Bachelor's degree or equivalent experience in information security or computer science.
• 5+ years in application security or security engineering.
• Experience securing CI/CD pipelines, GitHub Actions, including SAST/DAST and secret/dependency scanning.
• Familiarity with Terraform IaC security configurations.
• Working knowledge of SIEM/EDR/DLP platforms and alert triage.
• Understanding of HIPAA/HITECH/HITRUST in a security context.

Responsibilities

• Collaborate with development teams to embed security across the SDLC and CI/CD pipelines.
• Enforce secure coding standards to protect data confidentiality, integrity, and availability.
• Conduct in-depth security assessments, code reviews, and threat modeling on applications.
• Own and optimize GitHub Advanced Security workflows, triage findings, and improve coverage.
• Secure CI/CD pipelines, manage identities, runners, permissions, and secrets.
• Review Terraform/IaC for security issues and partner with IT on secure deployment practices.
• Ensure alignment with healthcare regulations (HIPAA, HITRUST, HITECH) and support audits.
• Remediate vulnerabilities with actionable guidance and timely patching.
• Develop, deploy, and manage security tooling to automate testing and scanning.
• Support security incident response and root-cause analysis.
• Lead security awareness initiatives for developers.
• Collaborate to reduce third‑party risk and implement best practices across teams.

Skills

Application security

CI/CD security

GitHub Advanced Security

SAST/DAST

Terraform IaC security

Cloud security (Azure/AWS)

Zero Trust

HIPAA/HITRUST compliance

Incident response

API security

Education

Bachelor's degree in information security or related field

Tools

GitHub Advanced Security

Snyk

Terraform

SIEM/EDR/DLP

HL7 data standards

Azure/AWS

Job description

TherapyNotes LLC is seeking an experienced Cyber Security Engineer to own application security across the SDLC and CI/CD pipelines in a healthcare‑regulated environment. You’ll secure CI/CD, code scanning, and IaC, while contributing to incident response and vulnerability management with a small security team.

The ideal candidate has 5+ years in security engineering, strong knowledge of HIPAA/HITRUST, and hands‑on tooling like SAST/DAST, Snyk, and GitHub Advanced Security.