Note: The job is a remote job and is open to candidates in USA. D24 Search is recruiting a Senior Security/AppSec Engineer for a high-growth digital health company. The role will own application, product, cloud, and identity security for a remote AWS healthcare platform, including security architecture, secure SDLC guardrails, non-human identity management, and GitHub Advanced Security automation.
Responsibilities
- Owning application and product security – threat modeling, secure design review, and secure code review focused on authorization and access-control flaw classes for a member-facing healthcare app and its APIs
- Designing and owning the security architecture for an agentic SDLC – building phase-gate criteria, deterministic out-of-band controls for agent-written code, and lifecycle management for non-human identities
- Securing the AWS environment – IAM, network segmentation, logging, configuration baselines, encryption, and workload protection across S3, EKS, and Terraform
- Building and running non-human identity and secrets management at scale – service accounts, scoped tokens, OAuth grants, and machine credentials with provisioning, rotation, and least privilege
- Enforcing and tuning GitHub Advanced Security (CodeQL, secret scanning, push protection) as required status checks and building automation so a small security function operates with outsized leverage
Skills
- No Visa transfers
- We are looking for a Senior Security Engineer with 5+ years of experience to be the first dedicated security hire at a high-growth digital health company
- Must have experience in building security solutions at a company with less than 500 employees
- Familiarity with AWS, regulated industry experience, and proficiency in Python or Go are required
- Application/product security AND AWS cloud security in a regulated industry
- Hands- on expertise with secure SDLC tooling (SAST/DAST, GitHub Advanced Security)
- 6+ years of experience in security engineering, with depth in AppSec and AWS cloud security
- Proficient in Python and shell scripting for automation
- Working knowledge of HIPAA, SOC 2, and NIST CSF
- Security certification (OSCP, GIAC, CISSP)
- Strong in IAM: Okta, OAuth/OIDC, SAML, NHI management
Benefits
- Equity
- Remote (US ONLY)
Company Overview