Senior Application Security Manager, Included Health
$188.3-345.7k
+ Equity. Salary may vary by location.
Digital healthcare provider
Open for applications
Digital healthcare provider
1001+ employees
Open for applications
$188.3-345.7k
+ Equity. Salary may vary by location.
1001+ employees
Company mission
To raise the standard of healthcare for everyone, everywhere.
Role
Who you are
- 8+ years of experience in security engineering, with at least 3+ years as a direct people manager leading security teams
- A strong track record of building and scaling Application Security programs in cloud-native SaaS environments (AWS strongly preferred)
- Hands-on-keyboard proficiency in a modern programming language (e.g., Go, Python), with the ability to perform meaningful code reviews and guide technical architecture
- Demonstrated success leading vulnerability management programs, from detection through remediation and verification
- Deep experience with the tools and processes used to secure the SDLC, including SAST, DAST, SCA, and CI/CD pipeline integration
- Proven ability to run effective threat modeling exercises for complex applications and services
- Excellent communication skills, with the ability to articulate complex security risks and strategies to both technical and executive audiences
- Experience securing platforms in a regulated healthcare environment and deep familiarity with HIPAA and HITRUST controls
- Background in running external-facing security programs like bug bounty, responsible disclosure, or customer security reviews
- Familiarity with Infrastructure as Code (IaC) principles and tools like Terraform, and an understanding of how they influence application security
- Experience navigating compliance frameworks beyond healthcare, such as ISO 27001 or SOC 2
- Capability to remain seated in a stationary position for prolonged periods
- Eye-hand coordination and manual dexterity to operate keyboard, computer and other office-related equipment
- Capability to work with leadership, employees, and members in an appropriate manner
What the job involves
- The Senior Engineering Manager, Application Security leads the teams responsible for Product Security, Vulnerability Management, and Security Assessments
- This role is responsible for defining and executing the application security roadmap to protect member data (PHI) within a cloud-native environment, primarily AWS
- The manager guides the team in building automated security solutions, maturing the secure SDLC, and partnering with engineering to embed security into the development process
- This is a remote role reporting to the Chief Information Security Officer
- Manage, mentor, and grow the Application Security, Vulnerability Management, and Security Assessment teams, fostering a culture of engineering excellence and proactive security ownership
- Define and execute the application security roadmap, directly contributing to our top priority of preventing PHI exposure
- Serve as a technical leader and mentor, guiding the team's architectural decisions and fostering engineering excellence in languages like Go and Python
- Evolve our secure SDLC through the strategic implementation of SAST, DAST, and SCA tooling, focusing on actionable results and a positive developer experience
- Champion and guide the strategy for modern access control, including Just-In-Time (JIT) access and other least-privilege initiatives, in partnership with the Cloud Security team
- Oversee key security programs including threat modeling, bug bounty, penetration testing, and vulnerability management
- Partner with engineering and product leaders to ensure security and privacy are designed into our products from the very beginning
Our take
As the name suggests, Included Health is on a mission to raise the standard of healthcare for everyone, offering inclusive, integrated virtual care and navigation.
It differentiates itself from competitors with its emphasis on improving health outcomes and challenges faced by communities including LGBTQ+ and BIPOC. The negative healthcare experiences faced by these marginalised groups means they often avoid care at a rate that is around 3x greater than the border US population, putting their health at risk.
With healthcare still fragmented and focused on one-size-fits-all solutions, Included Health is disrupting the market by using technology to match patients quickly with the best care, no matter where they live. It currently counts retail behemoths Walmart and Home Depot as customers.
Freddie
Company Specialist at Welcome to the Jungle
Insights
16% employee growth in 12 months
Company
Funding (last 2 of 6 rounds)
Sep 2020
$175m
GROWTH EQUITY VC
May 2018
$66m
SERIES D
Total funding: $347m
Company benefits
- Comprehensive medical, dental and vision plans
- All employee spouses and children can access Included Health services at no cost
- For time off, take it when you need it with our unaccrued discretionary time off for all exempt employees
Company HQ
Financial District, San Francisco, CA
Leadership
Owen Tripp
(CEO & co-founder)Previously served as a Senior Consultant at Accenture before joining eBay as the Manager and Founder of User Behaviour Intelligence in 2004. Co-founded Reputation.com in 2006, and served as its COO from 2008 to 2012. Was an Advisor at Pathbrite and Life360.
Lawrence "Rusty" Hofmann
(Co-Founder)Studied Medicine at Ohio State, Johns Hopkins and Stanford. Was Assistant Professor at Johns Hopkins from 2000 to 2005, and is now Professor of Interventional Radiology at Stanford. Co-founded Grand Rounds, rebranded to Included Health, in 2012. Is Medical Director at Stanford Health Care.
Share this job
View 16 more jobs at Included Health