AppSec Engineer — Backend, APIs & Cloud Security

US Health Partners, LLC; United States; Hybrid; USD 120,000 - 170,000; Full time

Benefits offered by this job

Unlimited time off

Flexible working (work from home or in

Health, dental, vision coverage (US)

401(k) with company match

Equity plan

Wellness stipend

In-office meals

Team summits

Job summary

Rain is seeking an application security expert to act as the quality bar for non-chain findings. You will determine what is real, how severe it is, and what must be fixed before launch. You will work with engineers to ensure secure, compliant money movement and robust backend and edge defenses.

You will own the security lifecycle from vulnerability assessment to remediation, collaborating with Security Operations and engineering teams to raise the overall security posture of Rain’s platform.

Qualifications

• Minimum 4+ years in application or product security or security-minded backend engineering.
• Ability to read unfamiliar codebases (TypeScript/Node.js) and identify relevant issues.
• Hands-on cloud security experience, preferably Google Cloud Platform (GCP).
• Experience with threat modeling and architecture reviews.
• Familiarity with security tooling and automated checks; ability to ship checks over docs.

Responsibilities

• Review red team findings, reproduce, prune false positives, set severity, and write actionable tickets.
• Harden backend services and APIs, especially money-moving paths; implement fixes.
• Own edge defenses: DDoS protection, rate limiting, WAF rules, abuse controls.
• Create secure configuration baselines for cloud, code, and SaaS; convert to automated checks.
• Grow the security gate to block more bugs before merge.
• Own attack surface coverage; run architecture reviews for high-risk systems.
• Evaluate security tools and decide whether to buy, adopt, or build them.

Skills

Application Security

Security Leadership

Cloud Security

Threat Modeling

Terraform

WAF

Rate Limiting

CI/CD Security

Education

Bachelor's degree in CS or related field

Tools

GCP

Terraform

WAFs

Job description

Rain is seeking an application security expert to act as the quality bar for non-chain findings. You will determine what is real, how severe it is, and what must be fixed before launch. You will work with engineers to ensure secure, compliant money movement and robust backend and edge defenses.

You will own the security lifecycle from vulnerability assessment to remediation, collaborating with Security Operations and engineering teams to raise the overall security posture of Rain’s platform.