Senior Application Security Engineer, HeartFlow

• If you enjoying working with talented engineers to solve complex technical challenges and want to want to see your work make a direct difference in patient outcomes, we encourage you to apply
• Security Communication – Ability to reason about risk in complex environments and communicate that risk to technical and non-technical audiences. Experience leading training, speaking internally/externally about security projects valued
• Securing SDLC – Experience building or improving secure SDLC activities, including threat modeling, code review, security testing and vulnerability management
• Programming Skills – Experience writing and maintaining code in at least one modern programming language and with at least one scripting language (Heartflow uses C++/Python). Comfortable with testing frameworks and CI/CD pipelines
• Infrastructure as Code & Cloud – Familiarity with AWS (or equivalent cloud providers) and configuration tools (Terraform, Chef, Ansible). Experience with containerization (Docker, Kubernetes) and orchestration (GitHub Actions or similar)
• Education & Experience – BS in Computer Science (or related degree) or relevant certifications and equivalent experience. 4+ years experience working in Application Security
• Regulated Environment Readiness – Understanding of—or willingness to learn—compliance, documentation, and quality requirements in medical or similarly regulated fields

Desirable

• We are looking for a Senior Application Security Engineer to work with our engineering team to ensure security is an integral part of our Software Development Lifecycle (SDLC)
• In this role, you’ll have the chance to use your security background to protect patients as we build products that leverage AI to improve healthcare
• Partner with the engineering team to define secure coding practices, threat model our products and carry out essential parts of a secure SDLC
• Collaborate with DevOps on identifying and implementing developer tools that support security best practices and identify security risks and vulnerabilities
• Drive vulnerability identification using SAST, DAST and SCA tooling and manage external penetration testing
• Support engineering team on vulnerability management, including risk assessment, remediation and improving identification of vulnerabilities
• Build security awareness through training on secure coding practices, security standards and latest security threats
• Translate security and privacy compliance requirements into technical requirements and support information security team through