Application Security Engineer, AKASA

• 5+ years of experience in application security
• You’ve written production code and can read, review, and critique code in at least one modern language (Python, Go, Java, TypeScript, etc.)
• Solid working knowledge of common vulnerability classes (OWASP Top 10, injection attacks, auth flaws, insecure deserialization, etc.) and how to fix them
• Hands-on experience with threat modeling and secure code review—you’ve done these against real systems, not just studied them
• Experience working with security tooling in CI/CD pipelines (SAST, SCA, secret scanning, GitHub Actions, etc.)
• Familiarity with cloud environments (AWS) and container/Kubernetes basics from a security angle
• Working understanding of auth standards (OAuth 2.0, OIDC, SAML) and API security concepts (REST, GraphQL)
• You’re collaborative, you’d rather help a developer fix something than file a ticket and walk away
• You communicate clearly. You can explain a vulnerability to an engineer and to a product manager without losing accuracy
• You’re organized enough to juggle multiple findings and remediation efforts across teams without things slipping
• You’re comfortable asking questions and navigating ambiguity in a fast-moving environment
• You care about the mission; these systems handle patient data, and that responsibility resonates with you

Desirable

• We’re hiring an Application Security Engineer to work hands-on with our engineering teams to find and fix vulnerabilities, harden our applications, and keep security woven into how we build software
• This is a practitioner role; you’ll spend your time in code, in tooling, and in design reviews, not writing strategy decks or managing people
• You’ll report to our security leadership and collaborate daily with developers across the stack. The systems you help protect handle sensitive patient data, so the work carries real weight
• Perform secure code reviews, threat modeling, and security design reviews for new features and services
• Use AI to automate tooling like SAST, DAST, SCA, secret scanning, and container scanning tools across our CI/CD pipelines
• Use AI to triage and validate vulnerability findings from automated tools, penetration tests, and bug bounty submissions. Track remediation to closure
• Work directly with engineering squads to fix security issues, helping developers understand the “why” and the fix, not just the finding
• Support third-party penetration tests: scoping, coordination, triage, and follow-through on results
• Contribute to developer security guides and training grounded in our actual codebase and stack
• Help maintain and improve our vulnerability management workflows and tracking using AI
• Support compliance work related to HIPAA and SOC 2 where it touches application and data security
• Stay current on the threat landscape and flag emerging risks relevant to our technology and industry