Application Security Engineer — SDLC & CI/CD Expert

TherapyNotes.com; United States; Remote; USD 110,000 - 150,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Retirement plan with company match

Profit sharing

Onboarding and mentoring program

Job summary

TherapyNotes LLC seeks an experienced Cyber Security Engineer to own application security across the SDLC and CI/CD, in a healthcare-regulated environment. You will secure pipelines, code, and infrastructure-as-code, while contributing to vulnerability management and incident response within a small team.

The role requires strong expertise with GitHub Actions, SAST/DAST, and third-party risk, plus experience with cloud security and HL7-style healthcare data standards.

Qualifications

• Bachelor’s degree in information security, computer science, or related field preferred; equivalent experience considered.
• 5+ years in application security or security engineering.
• Experience securing CI/CD pipelines and GitHub Actions, including SAST/DAST, secret/dep scanning triage.
• Review Terraform or other IaC for security misconfigurations.

Responsibilities

• Collaborate with development teams to secure SDLC and CI/CD.
• Enforce secure coding standards to protect data confidentiality, integrity, and availability.
• Conduct in-depth security assessments, code reviews, and threat modeling.
• Own and operate GitHub Advanced Security, triage findings, and improve scanning coverage.
• Secure CI/CD pipelines and GitHub Actions, manage identities, runners, permissions, and secrets.
• Review IaC for security issues and coordinate secure deployment practices.
• Ensure measures align with HIPAA/HITRUST/HITECH and support audits.
• Remediate vulnerabilities with developers and guide patching.
• Develop, deploy, and manage security tooling to automate testing.
• Support security incident response and root-cause analyses.
• Contribute to security awareness programs for developers.

Skills

CI/CD security

GitHub Actions

SAST/DAST

IaC security

HIPAA/HITRUST knowledge

Cloud security (Azure/AWS)

On-call rotation

Education

Bachelor’s degree in information security or related field

Tools

GitHub Advanced Security

Snyk

Terraform

SIEM/EDR/DLP

Job description

TherapyNotes LLC seeks an experienced Cyber Security Engineer to own application security across the SDLC and CI/CD, in a healthcare-regulated environment. You will secure pipelines, code, and infrastructure-as-code, while contributing to vulnerability management and incident response within a small team.

The role requires strong expertise with GitHub Actions, SAST/DAST, and third-party risk, plus experience with cloud security and HL7-style healthcare data standards.