Product Security Engineer I — Threat Modeling & CI/CD Security

NextGen Healthcare; Georgia; On-site; USD 120,000 - 180,000; Full time

Job summary

NextGen Healthcare is seeking a security-focused professional to join our team as a product security engineer. The role emphasizes security reviews, threat modeling, and the development of secure product tooling and guidelines.

You will provide security guidance across the software development lifecycle, evaluate new security technologies, and help integrate security into CI/CD pipelines while reducing false positives through tuned rules. Collaboration with engineering is essential.

Qualifications

• 5+ years of experience in product security, application security, or software engineering.
• Experience with security tools and frameworks (e.g., OWASP, NIST, etc.).
• Experience with security testing methodologies and tools (static analysis, dynamic analysis, pentesting).

Responsibilities

• Perform security reviews and threat modeling of product features and architectures.
• Develop and maintain security tooling, guidelines, and standards for product development.
• Provide security guidance and support to product teams throughout the SDLC.
• Research and evaluate new security technologies and solutions.
• Stay up to date with the latest security trends and threats.
• Integrate security tools into CI/CD and finetune rules to reduce false positives.
• Write scripts to automate manual tasks.
• Perform other duties that support the overall objective of the position.

Skills

Threat modeling

Security tooling

Security guidance

Programming (Python/Java/C#)

Education

Bachelor's degree in computer science or related field

Combination of education and experience

Tools

OWASP

NIST

Job description

NextGen Healthcare is seeking a security-focused professional to join our team as a product security engineer. The role emphasizes security reviews, threat modeling, and the development of secure product tooling and guidelines.

You will provide security guidance across the software development lifecycle, evaluate new security technologies, and help integrate security into CI/CD pipelines while reducing false positives through tuned rules. Collaboration with engineering is essential.