Application Security Engineer

November 18

Apply Now

Receive Emails with Similar Jobs

SimplePractice

WebsiteLinkedInAll Job Openings

Healthcare Insurance • SaaS

SimplePractice is an all-in-one practice management software platform tailored for behavioral health professionals. It simplifies administrative tasks, ranging from scheduling and billing to documentation, and enhances client care through integrated telehealth, insurance tools, and a vast template library. Trusted by over 200,000 practitioners, SimplePractice is designed for therapists, speech-language pathologists, occupational therapists, and psychiatrists, among others. It aims to streamline admin work and improve care management for practitioners, ultimately facilitating better client interactions and practice growth.

201 - 500 employees

Founded 2012

⚕️ Healthcare Insurance

☁️ SaaS

📋 Description

• Design, build, and implement secure solutions and automation to embed security testing and controls within the SDLC, serving as a hands-on expert in secure development practices. • Partner with engineering teams to move from reactive security fixes to proactive, embedded security in their development workflows. • Collaborate with product and engineering teams to perform security reviews, threat modeling, and design reviews for new features and architectural changes. • Actively develop and contribute code to internal security tools, security testing frameworks (e.g., SAST, DAST, SCA), and defensive libraries to proactively identify and address vulnerabilities. • Lead incident response for application-related security events, focusing on root cause analysis and implementing preventative controls. • Integrate security capabilities directly into CI/CD pipelines and engineering workflows to automate vulnerability detection and remediation. • Design and implement security architecture for web applications, APIs, and microservices, ensuring security by design. • Develop secure coding standards, security patterns, and reusable components for application development and deployment. • Conduct threat modeling across the application portfolio to identify and prioritize risks. • Establish and maintain security controls for development, staging, and production environments. • Translate application security strategies into actionable development plans and prototypes. • Evaluate third-party components, libraries, and SaaS providers for security, compliance, and data protection. • Assess emerging application security tools and technologies. • Review cloud-based services and configurations for compliance and security posture. • Partner with legal and compliance teams to ensure application security initiatives meet regulatory (e.g., HIPAA, HITECH) and contractual requirements. • Implement and monitor controls for data privacy, integrity, and access management within the application layer. • Develop metrics and reporting for the application security posture across engineering teams. • Liaison with customers and auditors on SimplePractice’s approach to application security and compliance. • Leverage automation to operationalize security and compliance workflows, continuously monitoring and improving our security posture.

🎯 Requirements

• 5+ years of experience in information security, with recent focus on application security, secure SDLC, and partnership with engineering. • Proven hands-on experience in designing, developing, and deploying security controls and automation, including expertise in code review, vulnerability remediation, and security testing. • Strong background in security architecture and threat modeling for modern web applications and APIs. • Strong bias towards automating security tasks and processes to scale the program. • Demonstrated experience in implementing security controls within a regulated environment (e.g., healthcare, finance), with a strong emphasis on practical application and automation. • Degree in Computer Science, Cybersecurity, or a related field. • Demonstrated experience with serverless cloud technologies (e.g., Lambda, Cloud Run) and/or containerization and orchestration (e.g., Docker, Kubernetes). • Strong software development background with proficiency in ruby, python, rust, go, or similar languages, including experience with DevSecOps practices and tools such as Terraform, Git, and CI/CD pipelines. • Understanding of healthcare compliance (HIPAA, HITECH) is highly desirable. • Excellent analytical, problem-solving, and communication skills, especially the ability to explain security risks to engineering partners. • Ability to work independently to learn new technologies, processes, and frameworks.

🏖️ Benefits

• Medical, dental, vision, life & disability insurance • 401(k) plan with company match • Flexible Time Off (FTO), wellbeing days, paid holidays, and summer Fridays • Mental health resources • Paid parental leave & Backup Care • Tuition reimbursement • Employee Resource Groups (ERGs)