Senior Application Security Engineer

Job summary

Responsibilities

We are scaling our healthcare AI platform, with more products, integrations and AI agents, and more protected health information (PHI) flowing through them. To keep pace, we're growing our security engineering team and looking for an exceptional Senior Security Engineer.

• Partner with the product squads as their go-to security engineer: design reviews, per-feature threat modeling, and fast, opinionated answers on authN/authZ, tokens and session…
• Secure our authentication and authorization surfaces (OAuth clients, one-time codes, multi-org tenancy, the Core API user API, embedded/postMessage SDKs) and hunt for BOLA, IDOR…
• Run the code-security findings loop: triage and prioritize results from our SAST, SCA, secrets and IaC scanners and AI-driven code review, route them to the right owners with…
• Secure our AI/LLM features and internal agents, covering prompt injection, tool and permission scoping for autonomous agents, PHI leakage, de-identification assurance and…
• Run the external testing program: scope and run pentests (web, mobile, backoffice), validate fixes, operate our vulnerability disclosure program, and stand up a bug bounty.

What they're looking for

• 5 to 8+ years in security engineering, including at least 2 to 3 years in application or product security, or experience as a software engineer with a strong security focus.
• Deep understanding of modern web and API security: OAuth 2.0 / OIDC, session and token design, multi-tenancy, and the OWASP Top 10 and API Top 10.
• Strong coder, comfortable reading and fixing production code (mostly Kotlin and Python, plus web, mobile and desktop clients) and automating in Python.
• Experience running threat modeling and security design reviews, and operating SAST, SCA and secrets scanning in CI with a real triage loop, not just a dashboard.
• Genuine breadth: comfortable moving between an API design review, a supply-chain hardening PR and an incident in the same week, and honest about what you don't know yet.

Tech stack

• Python
• GCP