Note: The job is a remote job and is open to candidates in USA. Ceresti Health is a tech-enabled dementia care provider. The Security Engineer partners with Engineering to secure code and cloud systems, build security tooling and automation, test for vulnerabilities, and contribute to security architecture.
Responsibilities
- Build and maintain threat models for new and existing systems and features, and keep them current as architecture changes
- Read checked-in code and assess its security. This role reviews code; it does not only review reports about code
- Own Snyk and Docker Scout: thresholds, findings, and driving remediation with the owning teams
- Review the software bill of materials for outdated or vulnerable components and push fixes through to closure
- Review SAST and DAST output, prioritize what matters, and work the remediation with engineers directly
- Build security utility tools and automation that Engineering and the wider company use
- Write scripts for logging, data parsing, and signal enrichment that make controls smarter rather than noisier
- Integrate security systems with developer tooling so the safe path is the convenient one
- Build and tune detection logic and automation that the Security Analyst operates day to day
- Build penetration tests and attack simulations using AI and the tools we already run, and use Dev, QA, and Test as a test bed to demonstrate real exposure
- Feed results from Pentest-Tools and internal testing back into what you build next
- Scope, coordinate, and manage the independent third-party penetration test required for SOC 2 and HITRUST, and track findings to closure
- Contribute to security architecture and standards, as well as detection logic
- Represent security in engineering initiatives including the mobile app, tablet software, the data lake, and AI and machine-learning work
- Help secure the production cloud environment (AWS via Aptible) as part of Engineering's platform, as code wherever possible
Skills
- Five to seven years in software or security engineering. Not a first engineering job
- You write code comfortably and would be at home on a development team. Python, Go, or similar
- Hands-on application security: threat modeling, dependency and container scanning, and reading code for security flaws
- Working knowledge of cloud security in AWS, and of CI/CD pipelines and where security fits in them
- Offensive fundamentals: you can think like an attacker and build a test that proves a point
- The ability to explain a finding to an engineer in terms they will act on
- Experience with Snyk, Docker Scout, or comparable SAST, SCA, and container tooling
- Detection engineering: writing and tuning rules that hold up in production
- An OSCP-type certification, or equivalent demonstrable offensive work
- Healthcare, or another environment handling regulated data
- Experience in a company where security was being built rather than inherited
Benefits
- Full-time remote work
- Comprehensive health, dental, and vision benefits
- Equity participation in a growing healthcare technology company
- PTO and a culture that respects it
- A collaborative, mission-driven environment where your work directly supports family caregivers and improves outcomes for people living with dementia
Company Overview
Company H1B Sponsorship