Staff Cloud Security Engineer, Included Health
$174.3-320.1k
Salary varies dependent on location. Plus Equity
Digital healthcare provider
Open for applications
Digital healthcare provider
1001+ employees
Open for applications
$174.3-320.1k
Salary varies dependent on location. Plus Equity
1001+ employees
Company mission
To raise the standard of healthcare for everyone, everywhere.
Role
Who you are
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field
- 5+ years of experience in cloud security, with a strong emphasis on designing, developing (primarily in Python and Go), and implementing security solutions in AWS
- Proven hands-on software development experience, particularly in Python and Go, for security automation, building security tools, and infrastructure management
- Demonstrable experience designing and implementing robust authorization and access control frameworks (e.g., RBAC, ABAC, policy-as-code) and Just-In-Time (JIT) access solutions
- Experience with Infrastructure as Code (IaC) with deep proficiency in writing and maintaining Terraform modules for security
- Experience with containerization (Docker, Kubernetes/EKS), including hands-on experience hardening containerized environments
- Experience with SDLC security, CI/CD pipeline security integration, and secure software development practices
- Experience with security logging, monitoring, alerting tools (e.g., SIEM, AWS CloudTrail, CloudWatch, GuardDuty), and scripting against their APIs (Python, Go)
- Experience with cloud security frameworks (especially HIPAA), regulations, and standards
What the job involves
- The Staff Cloud Security Engineer is a critical, hands-on technical role responsible for engineering, implementing, and automating robust security controls within our cloud environments (AWS primarily, with GCP considerations)
- This role is pivotal in maturing our cloud security posture, securing Included Health's product infrastructure, and directly contributing to the prevention of unauthorized PHI exfiltration
- You will help design and develop advanced security solutions, often through code (primarily Python and Go) and automation (Terraform), to address critical challenges in access control, development environment security, and infrastructure hardening
- This role requires deep technical expertise in cloud security, strong software development skills for building security tools and automation, and a proactive approach to risk mitigation
- You will be a key technical peer to our infrastructure software and engineering teams, driving a culture of security by design and helping to implement solutions that reduce HIPAA incidents
- This is a remote role reporting to the Chief Information Security Officer
- Design, develop, and implement a comprehensive authorization framework for cloud resources, addressing user roles, resource-specific restrictions, task-based access, and granular engineering access
- Lead the technical implementation of Just-In-Time (JIT) access control systems for production environments (systems, secrets, data) to minimize standing privileges for engineering and platform teams
- Collaborate with engineering to integrate data classification (e.g., safe-harbor annotations) with access control mechanisms, ensuring that data sensitivity directly informs access decisions
- Develop and maintain security automation scripts, tools, and services in Python or Go to streamline security operations, vulnerability management, compliance checks, and incident response
- Write clean, maintainable, and testable code (primarily Python and Go; familiarity with Ruby is a plus) for security automation, building custom security integrations, and developing security-focused tools
- Implement and champion Infrastructure as Code (IaC) principles, specifically using Terraform, for programmatic definition, enforcement, and auditing of security configurations
- Contribute to the design and implementation of centralized security controls, such as an engineering-owned Web Application Firewall (WAF), to manage rate limiting, IP blocking, input validation, and request filtering
- Partner with engineering teams to establish and implement secure practices for managing the development toolchain (code generation utilities, linters, browser extensions, CLI tools, IDE plugins) to mitigate supply chain risks
- Design and help implement a secure, "blessed" mechanism for webhook testing in local development environments, blocking unauthorized tunneling tools
- Define, implement, and enforce container security hardening standards (e.g., least privilege, no unnecessary utilities, limited internet access) in collaboration with engineering teams
- Drive the remediation of legacy cloud environments, particularly in GCP, by inventorying, assessing, and improving security controls
- Design and implement solutions for granular data access control in cloud environments, particularly addressing compliance requirements for handling sensitive data
- Collaborate closely with infrastructure software, engineering, DevOps, and product teams to co-design and integrate robust, automated security controls into systems, architectures, and CI/CD pipelines
- Act as a subject matter expert on cloud security (AWS, GCP), providing guidance, code reviews (Python, Go), and technical expertise on secure cloud adoption, secure software development, and access control best practices
- Support organizational change management efforts related to new security controls and practices by providing technical rationale and assisting in the development of new workflows
- Conduct security assessments, threat modeling, and contribute to incident response, developing automation for prevention and faster response
- Develop and maintain comprehensive documentation for security architectures, controls, automation scripts, and incident response playbooks
Our take
As the name suggests, Included Health is on a mission to raise the standard of healthcare for everyone, offering inclusive, integrated virtual care and navigation.
It differentiates itself from competitors with its emphasis on improving health outcomes and challenges faced by communities including LGBTQ+ and BIPOC. The negative healthcare experiences faced by these marginalised groups means they often avoid care at a rate that is around 3x greater than the border US population, putting their health at risk.
With healthcare still fragmented and focused on one-size-fits-all solutions, Included Health is disrupting the market by using technology to match patients quickly with the best care, no matter where they live. It currently counts retail behemoths Walmart and Home Depot as customers.
Freddie
Company Specialist at Welcome to the Jungle
Insights
16% employee growth in 12 months
Company
Funding (last 2 of 6 rounds)
Sep 2020
$175m
GROWTH EQUITY VC
May 2018
$66m
SERIES D
Total funding: $347m
Company benefits
- Comprehensive medical, dental and vision plans
- All employee spouses and children can access Included Health services at no cost
- For time off, take it when you need it with our unaccrued discretionary time off for all exempt employees
Company HQ
Financial District, San Francisco, CA
Leadership
Owen Tripp
(CEO & co-founder)Previously served as a Senior Consultant at Accenture before joining eBay as the Manager and Founder of User Behaviour Intelligence in 2004. Co-founded Reputation.com in 2006, and served as its COO from 2008 to 2012. Was an Advisor at Pathbrite and Life360.
Lawrence "Rusty" Hofmann
(Co-Founder)Studied Medicine at Ohio State, Johns Hopkins and Stanford. Was Assistant Professor at Johns Hopkins from 2000 to 2005, and is now Professor of Interventional Radiology at Stanford. Co-founded Grand Rounds, rebranded to Included Health, in 2012. Is Medical Director at Stanford Health Care.
Share this job
View 23 more jobs at Included Health