Senior Application Security Engineer

🕒 October 2

🇺🇸 United States – Remote

💵 $172k - $200k / year

⏰ Full Time

🟠 Senior

💻 Application Engineer

👻 Ghost score 0%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Turquoise Health

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2020

🏥 Healthcare

💼 Consulting

☁️ SaaS

💰 $30M Series B - Turquoise Health on 2024-01

Healthcare • Consulting • SaaS

Turquoise Health is a healthcare transparency platform and SaaS company that aggregates, standardizes, and publishes hospital and health plan pricing data to make healthcare costs accessible and actionable. It provides machine-readable price files, patient cost-estimate tools, contracting and analytics software, and compliance solutions to hospitals, health systems, payers, employers, and life sciences organizations. The company’s products help organizations meet regulatory price-transparency requirements, compare provider costs, and enable consumers and enterprise customers to make cost-conscious healthcare decisions.

📋 Description

• Own application-layer security across Turquoise's platform • Build and run the application security scanning program, including SAST, DAST, dependency/SCA, container, and IaC scanning • Tune scanning tools to reduce noise and surface real risk • Triage findings from scans, penetration tests, and bug bounty reports • Prioritize findings by risk and track remediation through closure • Partner with engineering teams on vulnerability remediation, debugging, and code-level guidance • Help integrate security early into engineering, product, and design processes, SDLC, and CI/CD pipelines • Perform threat modeling and maintain secure-coding standards • Support incident response for application-layer security issues • Coordinate and help manage third-party penetration tests • Track and report security posture metrics, including open vulnerabilities, remediation SLAs, and scan coverage, to engineering and leadership

🎯 Requirements

• 5+ years of experience in application security, security engineering, or a related software engineering role with a security focus • Hands-on experience with SAST, DAST, and dependency/SCA scanning tools • Deep understanding of OWASP Top 10, authentication/authorization flaws, injection, SSRF, and other common vulnerability classes • Ability to review code and architecture to identify vulnerabilities and propose effective fixes • Experience with cloud environments; AWS preferred • Experience securing modern CI/CD pipelines • Strong communication skills to explain risk and remediation steps clearly • Collaborative, pragmatic approach to security • Experience in healthcare, fintech, or another regulated industry • Experience with compliance frameworks such as HIPAA, SOC 2, or GDPR • Security certifications such as OSCP, GWAPT, or CSSLP • Experience building or maturing an AppSec program from an early stage • Scripting or automation experience with Python, Go, Terraform, or other infrastructure-as-code tools • Red team experience performing internal campaigns and providing remediation reports • Current authorization to work in the United States • Turquoise does not sponsor employment visas or assume sponsorship of existing visas

🏖️ Benefits

• Equity options • Stellar health care plan options (Medical, Dental & Vision), with FSA, DCFSA, & HSA options • Company-sponsored disability & life insurance • Unlimited PTO • 401(k) + 4% Matching • Fully remote work + flexible working hours • $750 work-from-home setup budget • Paid biannual in-person company summits • Quarterly $150 co-hanging stipend to meet up with coworkers • Monthly $100 health and wellness benefit • Generous paid family leave • Annual $1,200 learning & development stipend