Security Engineer

calahealth; United States; Remote; USD 155,000 - 190,000; Full time

Benefits offered by this job

Remote-first

Job summary

Cala Health, a healthcare technology company, is hiring a Security Engineer to protect digital assets, infrastructure, and applications. The role blends hands-on defense with strategic oversight across vulnerability management, incident response, and security culture building.

Remote-first with optional hybrid work near San Mateo, CA; reports to Staff DevOps Engineer. The role focuses on vulnerability management, external pen tests, cloud security, and implementing controls across AWS/GCP

Qualifications

• Bachelor's degree in CS or related field.
• 3+ years in security engineering or related discipline.
• Hands-on with modern security tooling and platforms.
• Experience integrating security scanning into CI/CD pipelines.

Responsibilities

• Monitor dependencies and CVEs; integrate security scanning into CI/CD pipelines.
• Coordinate external pen tests and bug bounty programs; translate findings for engineering teams.
• Drive security remediation across infrastructure, networks, and applications with IAM, segmentation, secrets mgmt.
• Serve on Incident Response team; on-call, investigate SIEM/EDR/cloud logs; lead post-incident reviews.
• Design security tabletop exercises for technical teams and leadership; surface gaps.
• Maintain cloud security posture across AWS/GCP; track KPIs and aid SOC 2, ISO 27001, HIPAA controls.

Skills

Security engineering

Incident response

Cloud security

Python scripting

CI/CD security

Education

Bachelor's degree in CS/SE

Tools

Snyk

Dependabot

Burp Suite

Splunk

Datadog

Job description

Role overview

A healthcare technology organization developing non-invasive prescription therapies for chronic neurological conditions is hiring a Security Engineer to safeguard digital assets, infrastructure, and applications. The role blends hands-on technical defense with strategic thinking, spanning vulnerability management, incident response, penetration testing oversight, and security culture building across engineering teams. The position reports to the Staff DevOps Engineer and supports a remote-first workforce with optional hybrid work near a San Mateo, CA headquarters.

Responsibilities

• Monitor and manage open-source and third-party dependencies through Software Composition Analysis tools, track CVEs, and integrate security scanning into CI/CD pipelines.
• Coordinate external penetration tests and bug bounty programs, validate findings, and translate complex vulnerabilities into actionable remediation plans for engineering teams.
• Drive security remediation across infrastructure, networks, and applications, providing code and configuration review guidance and implementing controls such as IAM policies, network segmentation, and secrets management.
• Serve on the Incident Response team in an on-call rotation, investigate anomalies in SIEM, EDR, and cloud logs, and lead post-incident reviews with documented lessons learned.
• Design and facilitate security tabletop exercises for technical teams and executive leadership, simulating realistic threat scenarios to test response plans and surface gaps.
• Maintain cloud security posture across AWS/GCP environments, define KPIs such as Mean Time to Remediate and patch compliance, and support evidence gathering for SOC 2, ISO 27001, and HIPAA-aligned controls.

Requirements

• Bachelor's degree in Computer Science, Software Engineering, or a related technical field.
• Three or more years of experience in security engineering, application security, or incident response.
• Hands-on experience with modern security tooling such as Snyk, Dependabot, Burp Suite, Splunk, or Datadog.
• Strong understanding of the OWASP Top 10, CWE, and cloud security best practices.
• Experience integrating security scanning into CI/CD pipelines using Jenkins, GitHub Actions, or GitLab CI.
• Proficiency in Python and Bash scripting for security automation and custom tooling development.

Nice to have

• Familiarity with additional languages such as Go, JavaScript/TypeScript, or Rust for deeper code reviews and custom tooling.
• Experience securing cloud-native environments with Docker and AWS/GCP, including native tools like AWS Inspector and GuardDuty.
• Hands-on use of GRC platforms, Infrastructure as Code security scanning tools, or bug bounty services.
• Relevant certifications such as CISSP, CEH, OSCP, GCIH, or AWS Certified Security.
• Background working with connected IoT devices, including provisioning, key rotation, and OTA update security.

Benefits and work setup

• Full-time, exempt position with a pay range of $155,000 to $190,000, adjusted for experience, skills, market benchmarks, internal equity, and candidate location.
• Remote-first with optional hybrid work for candidates local to the San Mateo, CA headquarters.
• Authorization to work in the United States is required; visa sponsorship may be considered on a case-by-case basis.