Senior Application Security Engineer – Cloud & AppSec

K Health; New York (NY); On-site; USD 150,000 - 200,000; Full time

Job summary

K Health, based in New York, is seeking a Senior Security Engineer focused on AppSec to safeguard our healthcare platform. You will drive secure software practices across the SDLC, partner with product and engineering teams, and perform hands-on testing of web apps, APIs, and cloud services.

Responsibilities include building automated security testing in CI/CD, refining security tooling, and shaping enterprise‑scale security policies to protect patient data and ensure regulatory compliance.

Qualifications

• 4 years of professional experience in application, product or software security, operating as an individual contributor, OR as a software engineer that has pivoted into security
• Strong understanding of application security vulnerabilities and attack techniques, including OWASP Top 10 and API security risks
• Experience performing manual security testing of modern web applications, APIs and distributed systems
• Ability to review application architecture and source code for security weaknesses
• Experience integrating application security tools into modern CI/CD workflows
• Familiarity with static application security testing, dynamic testing, secrets detection, container security and infrastructure‑as‑code scanning
• Understanding of authentication, authorization, session management, cryptography, secrets management and secure API design
• Strong expertise in cloud technology (AWS, GCP, or Azure), modern programming languages, utilization of generative coding utilities, and the security implications of utilizing AI code development utilities.
• Demonstrated experience researching, establishing, and successfully rolling out enterprise‑wide security policies and guidelines.

Responsibilities

• Lead the development and implementation of robust application security protocols throughout the entire Software Development Lifecycle (SDLC).
• Partner with engineering teams to incorporate security into architecture, design, development, testing and deployment
• Perform hands‑on security testing of web applications, APIs, cloud‑native services and supporting infrastructure
• Build and improve automated security testing within CI/CI pipelines, including static analysis, dependency scanning, secrets detection, container scanning and dynamic testing
• Evaluate effectiveness of application security tools, improve tooling output quality and reduce unnecessary findings and developer friction
• Develop secure coding standards with developer‑focused documentation
• Contribute application security expertise to vulnerability management, during security incidents/investigations and post‑incident reviews
• Evaluate third party applications, libraries and APIs and integrations for security risk
• Ensure adherence to relevant healthcare regulatory and compliance requirements (e.g., HIPAA, GDPR, etc.) across all product lines and systems.

Skills

Application security

OWASP Top 10

API security

Security testing

CI/CD integration

Cloud security

Security architecture review

Automation

Tools

Datadog

Sumo Logic

Torq

flare.io

GCP

Entitle

Okta

Orca

GitLab

Prisma

Job description

K Health, based in New York, is seeking a Senior Security Engineer focused on AppSec to safeguard our healthcare platform. You will drive secure software practices across the SDLC, partner with product and engineering teams, and perform hands-on testing of web apps, APIs, and cloud services.

Responsibilities include building automated security testing in CI/CD, refining security tooling, and shaping enterprise‑scale security policies to protect patient data and ensure regulatory compliance.