Remote-First Application Security Engineer (DevSecOps)

Sound Physicians; United States; Hybrid; USD 75,000 - 110,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

401(k) with company match

Paid time off (PTO)

Job summary

Sound Physicians is seeking an Application Security Analyst to embed security into the software delivery lifecycle. You will partner with development, platform, and security teams to implement secure-by-default processes, automate checks, and reduce risk across the SDLC.

The role requires experience with SAST, DAST, SCA, and cloud security controls, plus ability to conduct threat modeling and secure code reviews in a fast-paced healthcare technology environment.

Qualifications

• Strong understanding of application security concepts and secure coding practices.
• Experience with cloud security controls and vulnerability management.
• Familiarity with OWASP Top 10 and security standards.

Responsibilities

• Integrate security controls and automated checks into CI/CD pipelines (SAST/DAST/SCA).
• Partner with developers to identify and remediate security risks early in the SDLC.
• Perform architecture reviews, threat modeling, and secure code reviews.
• Support vulnerability management and define risk-based SLAs.
• Create documentation and training on DevSecOps practices.

Skills

Application security

DevSecOps

SAST

DAST

SCA

Cloud security

CI/CD

Kubernetes

Python scripting

Education

Bachelor’s degree in Computer Science or Information Security

Industry certifications (CSSLP, GWAPT, OSWE, CEH)

Tools

Veracode

Checkmarx

Fortify

SonarQube

Snyk

Job description

Sound Physicians is seeking an Application Security Analyst to embed security into the software delivery lifecycle. You will partner with development, platform, and security teams to implement secure-by-default processes, automate checks, and reduce risk across the SDLC.

The role requires experience with SAST, DAST, SCA, and cloud security controls, plus ability to conduct threat modeling and secure code reviews in a fast-paced healthcare technology environment.