Senior AI‑Driven AppSec Engineer II (Remote)

Spring Health; United States; Remote; USD 180,000 - 205,500; Full time

Benefits offered by this job

Health benefits

401(k) match

Therapist network access

Parental leave

Noom program

Fertility care support

Wellhub membership

BrightHorizons child care support

Professional development reimbursement

Donation matching

Job summary

Spring Health, a global mental health company, seeks a Senior Application Security Engineer II to mature and expand AppSec programs, including SAST, SCA, DAST, and a Secure AI Development Lifecycle. Fully remote within the United States with occasional travel to NYC.

You will mentor engineers, contribute to AI-assisted threat modeling, and strengthen security across AI features and cloud infrastructure. The role requires 7+ years in application security, hands-on testing, CI/CD security, and

Qualifications

• 7+ years of professional experience in application security or a closely related security engineering discipline.
• Hands-on experience with DAST, SAST, and SCA tools, and manual testing techniques (OWASP, SANS Top 25).
• Security of CI/CD pipelines with commercial and custom-built tooling.
• Experience with IaaS cloud infrastructure (AWS, Azure, or GCP), container technologies, and service-oriented architectures.
• Familiarity with AI/LLM security concepts, prompt injection risks, adversarial inputs, and model supply-chain risks.
• Working knowledge of AI/LLM tooling to assess security risk and automation workflows.
• Experience implementing controls aligned to NIST CSF, HIPAA, HITRUST, ISO-27001, or SOC-2.
• Strong cross-functional collaboration with engineering, product, and leadership.

Responsibilities

• Advance secure-by-design practices across the SDLC and architecture reviews.
• Mentor engineers on secure coding, AppSec fundamentals, and career growth.
• Develop an AI-assisted threat modeling program to scale risk identification.
• Mature SAST, SCA, and DAST programs through rule tuning and coverage improvements.
• Perform security-focused code reviews of internal and open-source libraries.
• Support vulnerability remediation and validate fixes.
• Assess AI-integrated product features for risks like prompt injection and data leakage.
• Help design and implement a Secure AI Development Lifecycle (ADLC) per OWASP Top 10 for LLMs.
• Evaluate AI security tooling to improve coverage and efficiency.

Skills

DAST

SAST

SCA

CI/CD security

Cloud security

AI/ML security

LLM security

NIST CSF

HIPAA/HITRUST

SOC 2

Education

Bachelor's degree in CS or related field

Tools

OpenAI

Anthropic

LangChain

Job description

Spring Health, a global mental health company, seeks a Senior Application Security Engineer II to mature and expand AppSec programs, including SAST, SCA, DAST, and a Secure AI Development Lifecycle. Fully remote within the United States with occasional travel to NYC.

You will mentor engineers, contribute to AI-assisted threat modeling, and strengthen security across AI features and cloud infrastructure. The role requires 7+ years in application security, hands-on testing, CI/CD security, and