Remote Security Engineer: Incident Response & SecOps

Cala Health Inc.; United States; On-site; USD 110,000 - 160,000; Full time

Job summary

Cala Health Inc. is seeking a proactive Security Engineer for a full-time remote role to safeguard digital assets, manage vulnerabilities, and lead incident response across engineering teams.

You will monitor dependencies, oversee external penetration tests, conduct internal assessments, and collaborate with the Incident Response team to strengthen tooling and security culture. Strong collaboration with product and DevOps is expected to implement secure-by-design practices across the development

Qualifications

• 3+ years of experience in Security Engineering, Application Security, or Incident Response.
• Hands-on experience with security tooling such as Snyk, Burp Suite, and Splunk.
• Strong understanding of OWASP Top 10 and cloud security best practices.
• Proficiency in Python and Shell scripting for automating security workflows.
• Experience with CI/CD pipelines and integrating security scanning into build automation tools.

Responsibilities

• Monitor and manage open-source and third-party dependencies to identify and mitigate supply chain risks.
• Manage end-to-end execution of external penetration tests and conduct internal vulnerability assessments.
• Serve as a core member of the Incident Response team, analyzing security logs and conducting post-incident reviews.

Skills

Security engineering

Application security

Incident response

Python

Shell scripting

CI/CD pipelines

Security scanning

Tools

Snyk

Burp Suite

Splunk

Job description

Cala Health Inc. is seeking a proactive Security Engineer for a full-time remote role to safeguard digital assets, manage vulnerabilities, and lead incident response across engineering teams.

You will monitor dependencies, oversee external penetration tests, conduct internal assessments, and collaborate with the Incident Response team to strengthen tooling and security culture. Strong collaboration with product and DevOps is expected to implement secure-by-design practices across the development