Senior AppSec Engineer - Rails, AWS, FedRAMP

eVisit; Redmond (WA); On-site; USD 150,000 - 190,000; Full time

Job summary

eVisit is seeking a hands-on senior security engineer who will own end-to-end remediation of vulnerabilities identified through penetration testing. You will dive into Ruby on Rails and React code, session traffic, and infrastructure to fix root causes and prevent recurrence.

As security backlog clears, you will contribute to feature development on our Rails/React platform with a security-minded approach, collaborating with engineering and design teams to translate findings into concrete TRD

Qualifications

• 5+ years of hands-on software engineering experience across multiple applications and layers.
• Working proficiency in Ruby on Rails and React.
• Experience with containerized environments, AWS, and Fargate.
• Solid API experience with RESTful design and security considerations.
• Hands-on experience with Pusher and AnyCable, or similar real-time tech.
• Knowledge of Ruby data models and performance implications.

Responsibilities

• Own end-to-end remediation of vulnerabilities surfaced by penetration tests and security assessments.
• Feed remediation requirements into the TRD to capture durable design requirements.
• Review and harden session management across the stack.
• Implement fixes in Rails/React and containerized services (AWS Fargate).
• Secure real-time and RESTful APIs, and document findings and verifications.
• Contribute security context to FedRAMP discussions and requirements.

Skills

Ruby on Rails

React

AWS

RESTful APIs

Security remediation

Session management

Pusher

AnyCable

Full-stack engineering

Tools

Pulumi

AWS Fargate

Pusher

AnyCable

Job description

This is a senior-level security engineering role with a genuinely rare combination of requirements: deep full-stack development experience (Ruby on Rails + React) paired with hands‑on security remediation and FedRAMP familiarity. That intersection commands significant market value.

Compensation context: No salary is listed, but roles combining 5+ years of full-stack engineering with security engineering expertise and AWS Security certifications typically range from $150,000-$190,000+ in the U.S. market, with federal-adjacent roles sometimes adding clearance or compliance premiums.

• Penetration test remediation - translating pentest findings into code-level fixes is a highly marketable, hands‑on skill.
• FedRAMP compliance vocabulary and practices - valuable for any company pursuing government contracts.
• AWS Fargate / containerized security at the infrastructure layer.
• Real-time API security (Pusher, AnyCable) - a niche but growing area.

Green flags: The role promises genuine ownership ("own end-to-end remediation"), cross-functional collaboration, and a path back into feature development once the security backlog clears - avoiding the trap of purely reactive security work.

Potential red flags: The U.S. citizenship and federal background check requirements significantly narrow the candidate pool and suggest the team works under compliance-heavy conditions. No benefits or compensation are disclosed, and the lack of remote policy clarity is a concern for work-life balance planning.

Ideal for a senior engineer looking to pivot or deepen into AppSec without leaving development entirely behind.

We are looking for a hands‑on full-stack Software Engineer who will focus primarily on security remediation. Your first priority will be owning the remediation of vulnerabilities identified through penetration testing: not just reporting findings, but digging into the codebase, session traffic, and infrastructure to fix the underlying issues and prevent them from recurring. You will work closely with engineering and design teams to translate real-world security findings into concrete, testable requirements in our Technical Requirements Documents (TRDs), and you will personally implement or oversee the fixes.

This is an engineering role first. As the security backlog comes under control, you will have the flexibility to contribute to application development across our Ruby on Rails and React platform, bringing a security‑minded perspective to the features you build.

Key Responsibilities

Security Remediation

• Vulnerability Remediation: Own end-to-end remediation of vulnerabilities surfaced by penetration tests and other security assessments, from triage through verified fix.
• TRD Input: Feed vulnerability findings and remediation requirements directly into the Technical Requirements Document (TRD) process so fixes are captured as durable design requirements, not one‑off patches.
• Session Management: Review and harden session management practices across the application stack.
• Full-Stack Remediation: Work within a Ruby on Rails and React codebase and across containerized services (AWS, Fargate) to implement fixes at both the application and infrastructure layers.
• API and Real-Time Systems: Assess and secure real‑time and API‑driven features, including those built on Pusher and AnyCable, and RESTful APIs generally.
• Documentation: Produce clear, thorough documentation of vulnerabilities, root causes, remediation steps, and verification results.
• Compliance Support: Contribute security context and vocabulary to FedRAMP‑related discussions and requirements, partnering with compliance and engineering stakeholders.

Application Development

• Feature Development: Design, build, and ship features across the Ruby on Rails back end and React front end alongside the broader engineering team.
• Secure by Design: Apply what you learn from remediation work to new development, helping the team avoid reintroducing known classes of vulnerabilities.
• Code Quality: Participate in code reviews, testing, and technical design discussions, with an eye toward both security and maintainability.

Requirements

• 5+ years of hands‑on software engineering experience, with broad full‑stack work across multiple applications and technology layers.
• Working proficiency in Ruby on Rails and React.
• Experience with containerized environments, AWS, and Fargate.
• Solid API experience, including RESTful API design and security considerations.
• Hands‑on experience with Pusher and AnyCable, or comparable real‑time messaging technologies.
• Knowledge of Ruby data models and how schema and query design affect performance and scalability.

Security Experience

• 5+ years of experience in a security engineering or closely related role.
• Proven experience remediating vulnerabilities identified through penetration testing.
• AWS Security certification(s) (e.g., AWS Certified Security - Specialty).
• General familiarity with FedRAMP: enough understanding of the vocabulary and framework to contribute meaningfully to FedRAMP‑related project.

Analytical Skills

• Able to identify when too much information is being exposed between backend and frontend, and to explain the risk clearly to engineering and design stakeholders.
• Able to translate security findings into actionable design requirements that feed directly into the TRD.

Coding and Technical Skills

• Working proficiency in Ruby on Rails.
• Experience with containerized environments, AWS, and Fargate.
• Solid API experience, including RESTful API design and security considerations.
• Solid understanding of session management principles and common pitfalls.
• Hands‑on experience with Pusher and AnyCable, or comparable real‑time messaging technologies.
• Broad, full‑stack experience across multiple applications and technology layers.
• Knowledge of Ruby data models and how schema and query design affect performance and scalability.

Documentation

• Strong written communication skills, with the ability to document vulnerabilities, remediations, and technical requirements clearly for both engineering and non‑engineering audiences.
• U.S. citizenship required. Work is performed on U.S. federal health programs.
• Ability to pass a federal background investigation and obtain a Public Trust determination.

Nice to Have

• Experience with Pulumi for infrastructure as code.
• Active or eligible for security clearance.

Is this role open to non-U.S. citizens or remote workers outside the United States? No. U.S. citizenship is explicitly required because the work involves U.S. federal health programs, and candidates must be able to pass a federal background investigation and obtain a Public Trust determination. What is the primary focus of this engineering role - security or feature development? Security remediation is the first priority: owning end-to-end fixes for vulnerabilities identified through penetration testing. Once the security backlog is under control, the role transitions to broader application development on the Ruby on Rails and React platform. What security certifications are required or preferred? AWS Security certification(s) - such as AWS Certified Security - Specialty - are listed as a requirement. An active or eligible security clearance is listed as a nice‑to‑have. Is prior FedRAMP experience required? Full FedRAMP expertise is not required; the posting asks for general familiarity with the vocabulary and framework sufficient to contribute meaningfully to FedRAMP‑related discussions and requirements. What technology stack will I be working with? The primary stack is Ruby on Rails (back end), React (front end), containerized services on AWS Fargate, real‑time messaging via Pusher and AnyCable, and RESTful APIs. Nice‑to‑haves include Pulumi, Python, and SQL.

Remote work & career advice that actually works.