Cyber Security Engineer (Application Security)

TherapyNotes.com is seeking an experienced Cyber Security Engineer (Application Security) to own application security across the Software Development Lifecycle and the CI/CD pipeline. Based in Philadelphia, PA on an onsite schedule, this hands-on role connects secure development practices with automated testing, scanning, and security operations in a healthcare-regulated environment.

You will work with development and IT platform teams to harden CI/CD workflows, improve scanning coverage, review infrastructure-as-code, and help remediate vulnerabilities. The position also supports broader security engineering activities, including vulnerability management, incident response contributions, and identity and access security.

Role focus

• Own application security across the SDLC and CI/CD pipeline end to end.
• Secure CI/CD workflows including GitHub Actions by addressing identities, runners, permissions, and secrets.
• Reduce software supply chain risk through third-party action review, dependency controls, action pinning, and artifact provenance.
• Align application security practices with healthcare regulations and support regular audits (including HIPAA, HITRUST, and HITECH).

Responsibilities

• Collaborate with development teams to embed security continuously into the SDLC and CI/CD.
• Enforce secure coding standards to help reduce vulnerabilities and protect the confidentiality, integrity, and availability of customer data.
• Conduct security assessments, code reviews, and threat modeling to identify application vulnerabilities and risks.
• Own and operate GitHub Advanced Security, including triaging code, secret, and dependency-scanning findings, spotting recurring vulnerability patterns, and improving scanning coverage, configuration, and workflows.
• Review Terraform and other infrastructure-as-code for security issues, partnering with IT platform teams on IaC scanning and secure deployment practices.
• Work with developers to remediate vulnerabilities, providing actionable guidance and ensuring patching or mitigation measures are effective.
• Develop, deploy, and manage security tooling such as SAST, DAST, and vulnerability management systems to automate security testing and scanning.
• Support application security incident response activities by identifying root causes and contributing to resolution strategies.
• Contribute to security awareness programs for development teams focused on secure coding and proactive security.

Requirements

• 5+ years in application security or security engineering.
• A Bachelor’s degree in information security, computer science, or related field is preferred; equivalent experience will be considered.
• Demonstrated experience securing CI/CD pipelines and GitHub Actions, including SAST/DAST, code/secret/dependency scanning triage (for example GitHub Advanced Security or Snyk), runner and workflow permission security, and third-party action or supply-chain risk.
• Experience reviewing Terraform or other infrastructure-as-code for security misconfigurations.
• Working knowledge of SIEM, EDR/XDR, and DLP platforms, including deployment, tuning, and alert triage.
• Understanding of Zero Trust architecture principles as they apply to application and identity access.
• Strong understanding of healthcare regulations (HIPAA, HITRUST, HITECH) and how they affect application security.
• Experience with API security, especially integrations with other healthcare systems; familiarity with HL7 or other healthcare data standards is preferred.
• Prior experience securing cloud environments (Azure preferred, AWS a plus).
• Willingness to participate in an incident response on-call rotation.
• Industry certifications such as GWAPT, OSWE, GPEN, or a cloud security certification (Azure/AWS) are ideal; CISSP or HCISPP is a plus but not a substitute for hands-on tooling experience.

Technologies

• GitHub Actions, GitHub Advanced Security, Snyk
• SAST, DAST, Terraform
• SIEM, EDR/XDR, DLP
• Zero Trust, Azure, AWS
• HL7
• GWAPT, OSWE, GPEN, CISSP, HCISPP

Compensation and benefits

• Salary: $110,000 - $130,000 per year
• Employer sponsored health, dental, vision, life, and disability insurance
• Retirement plan with company contribution
• Annual company profit sharing
• Personal development and training budget
• Open, collaborative work environment
• Extensive 2-week onboarding plan
• Comprehensive mentorship program

Additional position details

• Contribute to security engineering beyond application security, including vulnerability management, incident response, and identity and access security as part of a small collaborative security team.
• Bring a continuous learning mindset and adapt quickly to new challenges and technologies.
• Demonstrate strong ownership, collaboration, and drive to see projects through to completion.