Cyber Security Engineer

TherapyNotes.com is hiring a hands-on Cyber Security Engineer in Philadelphia, PA (onsite) to strengthen application security across the SDLC and CI/CD pipeline. This role will focus on securing GitHub Actions and scanning workflows, reviewing infrastructure-as-code, and supporting vulnerability management, incident response, and identity and access security within a healthcare-regulated environment.

Role Overview

In this position, you will own application security practices spanning development workflows and deployment pipelines. The work includes securing CI/CD/GitHub Actions, improving scanning coverage and configurations, partnering on Terraform and other IaC reviews, and contributing to incident response activities. You will also help align security controls with healthcare regulations and support audit readiness.

Responsibilities

• Work with development teams to ensure security is integrated continuously into the SDLC and CI/CD pipeline.
• Apply and enforce secure coding standards to reduce vulnerabilities and protect the confidentiality, integrity, and availability of customer data.
• Conduct security assessments, code reviews, and threat modeling to identify vulnerabilities and related risks.
• Own and operate GitHub Advanced Security, triaging code, secret, and dependency scanning findings, identifying recurring vulnerability patterns, recommending broader fixes, and improving scanning coverage and workflow configurations.
• Secure CI/CD pipelines and GitHub Actions by addressing identities, runners, permissions, and secrets, and reduce software supply chain risk through third-party action review, dependency controls, action pinning, and artifact provenance.
• Review Terraform and other infrastructure-as-code for security issues, partnering with IT platform teams on IaC scanning and secure deployment practices.
• Ensure application security measures align with healthcare regulations and standards, including HIPAA, HITRUST, and HITECH, and support regular audits.
• Collaborate with developers to remediate vulnerabilities by providing actionable guidance and supporting effective patching or mitigation.
• Develop, deploy, and manage security tools and technologies such as SAST, DAST, and vulnerability management systems to automate security testing and scanning.
• Support application security incident response by helping identify root causes and contributing to resolution strategies.
• Contribute to security awareness efforts for development teams, emphasizing secure coding practices and proactive security measures.

Requirements

• Bachelor’s degree in information security, computer science, or a related field preferred; equivalent experience will be considered.
• 5+ years in application security or security engineering.
• Experience securing CI/CD pipelines and GitHub Actions, including SAST/DAST and code, secret, and dependency-scanning triage (for example, GitHub Advanced Security and Snyk), plus runner and workflow-permission security and third-party action or supply-chain risk controls.
• Experience reviewing Terraform or other infrastructure-as-code for security misconfigurations.
• Working knowledge of SIEM, EDR/XDR, and DLP platforms, including deployment, tuning, and alert triage.
• Understanding of Zero Trust architecture principles as they apply to application and identity access.
• Strong understanding of healthcare regulations including HIPAA, HITECH, and HITRUST and how they impact application security.
• Experience with API security, including integrations with other healthcare systems; familiarity with HL7 or other healthcare data standards is preferred.
• Prior experience securing cloud environments (Azure preferred, AWS a plus).
• Willingness to participate in an incident response on-call rotation.
• Industry certifications such as GWAPT, OSWE, GPEN, or a cloud security certification (Azure/AWS) are ideal; CISSP or HCISPP is a plus but not a substitute for hands-on tooling experience.

Key Technologies

• GitHub Actions, GitHub Advanced Security, Snyk
• Terraform
• SIEM, EDR/XDR, DLP
• Zero Trust architecture
• API security
• HL7
• Azure, AWS
• SAST, DAST
• Vulnerability management systems
• GWAPT, OSWE, GPEN, CISSP, HCISPP

Compensation and Benefits

• Competitive salary: $110,000-$150,000 per year
• Employer sponsored health, dental, vision, life, and disability insurance
• Retirement plan with company contribution
• Annual company profit sharing
• Personal development and training budget
• Open, collaborative work environment
• Extensive 2-week onboarding plan
• Comprehensive mentorship program

Additional Notes

• Commitment to continuous learning and staying current on emerging trends and technologies.
• Ability to take ownership of projects and drive them through to completion.
• Strong collaboration skills to work effectively with cross-functional teams.