Cyber Security Engineer

Cybersecurity Jobs; Philadelphia (Philadelphia County); On-site; USD 110,000 - 150,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Life insurance

Disability insurance

Retirement plan with company match

Profit sharing

Training budget

Mentorship program

Onboarding program

Job summary

TherapyNotes.com is seeking a hands-on Cyber Security Engineer to drive application security across the SDLC and CI/CD, with emphasis on GitHub Actions security and vulnerability management. The role involves securing CI/CD pipelines, triaging code and dependency findings, and enforcing secure coding standards to protect patient data.

You will review IaC, including Terraform, and collaborate with IT and development teams to ensure secure deployment practices while maintaining

Qualifications

• BS in information security or CS; equivalent experience considered.
• 5+ years in application security or security engineering.
• Proven experience securing CI/CD pipelines and GitHub Actions.
• Experience reviewing Terraform for security misconfigurations.
• Knowledge of SIEM, EDR/XDR, and DLP platforms.
• Understanding of Zero Trust architecture in app security.
• Healthcare regulations like HIPAA/HITRUST/HITECH knowledge.
• Experience with API security and HL7 data standards.
• Cloud security in Azure (AWS a plus).
• Willingness for on-call incident response.
• Industry certs such as GWAPT, OSWE, GPEN, or Azure/AWS cloud security certs; CISSP/HCISPP a plus.

Responsibilities

• Collaborate with development teams to embed security into SDLC and CI/CD.
• Enforce secure coding standards to reduce vulnerabilities and protect data.
• Conduct in-depth security assessments, code reviews, and threat modeling.
• Own and operate GitHub Advanced Security; triage findings and improve scanning.
• Secure CI/CD pipelines by addressing identities, runners, permissions, secrets.
• Review IaC (Terraform) for security issues with IT platform teams.
• Ensure security measures align with HIPAA, HITRUST, HITECH and audits.
• Partner with developers on vulnerability remediation with actionable guidance.
• Develop and manage security tooling (SAST/DAST, vulnerability mgmt).
• Support security incident response and root-cause analysis.
• Contribute to security awareness programs for dev teams.

Skills

CI/CD security

GitHub Actions

SAST/DAST

Vulnerability management

Incident response

Identity & access security

Healthcare regulations knowledge

Education

Bachelor's degree or equivalent experience

Tools

GitHub Advanced Security

Snyk

Terraform

SIEM

EDR/XDR

DLP

Job description

TherapyNotes.com is looking for a hands‑on Cyber Security Engineer to drive application security throughout the Software Development Lifecycle (SDLC) and the CI/CD pipeline. The position emphasizes securing CI/CD and GitHub Actions, improving automated scanning coverage, and supporting vulnerability management, incident response, and identity and access security in a healthcare‑regulated environment.

Role Focus

• Own application security across the SDLC and CI/CD pipeline, with emphasis on CI/CD and GitHub Actions security.
• Secure GitHub Advanced Security workflows, including triage of code, secret, and dependency scanning findings.
• Review infrastructure‑as‑code, including Terraform, and partner with IT platform teams to support secure deployment practices.
• Contribute to vulnerability management, incident response activities, and identity and access security.

Responsibilities

• Collaborate with development teams to embed security continuously into the SDLC and CI/CD pipeline.
• Enforce secure coding standards and best practices to reduce vulnerabilities and protect the confidentiality, integrity, and availability of customer data.
• Conduct in‑depth security assessments, code reviews, and threat modeling to identify application vulnerabilities and risks.
• Own and operate GitHub Advanced Security, triaging findings and identifying recurring vulnerability patterns to recommend broader fixes and improve scanning coverage, configuration, and workflows.
• Secure CI/CD pipelines and GitHub Actions by addressing identities, runners, permissions, and secrets, and reduce software supply chain risk through third‑party action review, dependency controls, action pinning, and artifact provenance.
• Review Terraform and other infrastructure‑as‑code for security issues, supporting IaC scanning and secure deployment practices with IT platform teams.
• Ensure application security measures align with healthcare regulations and standards such as HIPAA, HITRUST, and HITECH, and support regular audits.
• Partner with developers on vulnerability remediation by providing actionable guidance and ensuring effective patching or mitigation.
• Develop, deploy, and manage security tools and technologies, including SAST, DAST, and vulnerability management systems, to automate security testing and scanning.
• Support application security incident response activities, contributing to root‑cause identification and resolution strategies.
• Contribute to security awareness programs for development teams focused on secure coding practices and proactive security measures.

Requirements

• Bachelor’s degree in information security, computer science, or related field preferred (equivalent experience considered).
• 5+ years in application security or security engineering.
• Proven experience securing CI/CD pipelines and GitHub Actions, including SAST/DAST and triage of code, secret, and dependency scanning findings (e.g., GitHub Advanced Security, Snyk), with experience covering runner and workflow‑permission security as well as third‑party action and supply‑chain risk.
• Experience reviewing Terraform or other infrastructure‑as‑code for security misconfigurations.
• Working knowledge of SIEM, EDR/XDR, and DLP platforms, including deployment, tuning, and alert triage.
• Understanding of Zero Trust architecture principles as they apply to application security and identity access.
• Strong understanding of healthcare regulations including HIPAA, HITECH, and HITRUST and how they influence application security.
• Experience with API security, especially integrations with other healthcare systems; familiarity with HL7 or other healthcare data standards preferred.
• Experience securing cloud environments (Azure preferred, AWS a plus).
• Willingness to participate in an incident response on‑call rotation.
• Industry certifications such as GWAPT, OSWE, GPEN, or a cloud security certification (Azure/AWS) are ideal; CISSP or HCISPP is a plus and not a substitute for hands‑on tooling experience.

Technologies

• GitHub Actions, GitHub Advanced Security, Snyk
• Terraform
• SIEM, EDR/XDR, DLP
• Zero Trust architecture
• API security, HL7
• Azure, AWS
• SAST, DAST, vulnerability management systems
• GWAPT, OSWE, GPEN
• CISSP, HCISPP

Location

Philadelphia, PA (onsite)

Compensation

USD 110,000 - 150,000 per year

Benefits

• Competitive salary range: $110,000-$150,000
• Employer‑sponsored health, dental, vision, life, and disability insurance
• Retirement plan with company contribution
• Annual company profit sharing
• Personal development and training budget
• Open, collaborative work environment
• Extensive 2‑week onboarding plan
• Comprehensive mentorship program

Team Context

TherapyNotes.com is building a security program that supports application security across the SDLC and CI/CD pipeline. The role operates as part of a small, collaborative security team and includes responsibilities spanning vulnerability management, incident response, and identity and access security while working within healthcare regulatory expectations.