Cyber Security Engineer: Secure CI/CD, IaC & HIPAA

TherapyNotes, LLC; Philadelphia (Philadelphia County); On-site; USD 110,000 - 150,000; Full time

Benefits offered by this job

Health, dental, vision, life, and DIS

Retirement plan with company contrib.

Annual profit sharing

Personal development/training budget

Comprehensive mentorship program

Open, collaborative work environment

Job summary

TherapyNotes, LLC is seeking an experienced Cyber Security Engineer to own application security across our SDLC and CI/CD pipelines. The role focuses on securing CI/CD, code/scanning workflows, and IaC, within a HIPAA-regulated healthcare environment.

You will contribute to vulnerability management, incident response, and identity and access security as part of a small security team, while collaborating with cross-functional teams to protect patient data.

Qualifications

• Bachelor's degree or equivalent experience in information security, computer science, or related field.
• 5+ years in application security or security engineering.
• Experience securing CI/CD pipelines and GitHub Actions with SAST/DAST and secret/dependency scanning.
• Reviewing Terraform or IaC for security misconfigurations.
• Familiarity with SIEM/EDR/XDR and DLP platforms; alert triage.
• Understanding Zero Trust in app and identity access.
• Knowledge of HIPAA, HITECH, HITRUST regulatory impacts on security.
• Experience with API security and HL7 or healthcare data standards.
• Experience securing cloud environments (Azure preferred, AWS a plus).
• Willingness to participate in on-call incident response.
• Industry certifications (GWAPT, OSWE, GPEN) or cloud security certs are a plus.

Responsibilities

• Collaborate with development teams to embed security in the SDLC and CI/CD processes.
• Enforce secure coding standards to protect data confidentiality, integrity, and availability.
• Conduct security assessments, code reviews, and threat modeling to identify risks.
• Own and operate GitHub Advanced Security and drive triage of findings to improve coverage.
• Secure CI/CD pipelines: manage identities, runners, permissions, and secrets; review third-party actions.
• Review IaC (Terraform) for security issues and partner on secure deployment practices.
• Ensure security measures align with HIPAA/HITRUST/HITECH and support audits.
• Remediate vulnerabilities with actionable guidance and proper patching.
• Develop and manage security tools to automate testing and scanning.
• Support incident response and contribute to resolution strategies.
• Contribute to security awareness programs for developers.

Skills

CI/CD security

GitHub Actions

SAST/DAST

Secret/dependency scanning

Infrastructure security

Terraform/IaC security

SIEM/EDR/DLP

Zero Trust

HIPAA/HITRUST compliance

API security

Cloud security (Azure/AWS)

On-call readiness

Security certifications (GWAPT/OSWE/GP

Education

Bachelor's degree in information security, computer science, or related field

Tools

GitHub Advanced Security

Snyk

Terraform

Cloud security tooling (Azure/AWS)

Job description

TherapyNotes, LLC is seeking an experienced Cyber Security Engineer to own application security across our SDLC and CI/CD pipelines. The role focuses on securing CI/CD, code/scanning workflows, and IaC, within a HIPAA-regulated healthcare environment.

You will contribute to vulnerability management, incident response, and identity and access security as part of a small security team, while collaborating with cross-functional teams to protect patient data.