• Define and drive security architecture across applications, services, and infrastructure. • Partner with engineering teams to design and implement secure software systems, focusing on backend and data security. • Conduct threat modeling, risk assessments, and security reviews for new and existing products. • Develop and enforce secure coding practices, frameworks, and review processes. • Collaborate with DevOps on cloud and container security, CI/CD hardening, and access controls. • Evaluate and integrate security tools for code scanning, vulnerability management, and incident response. • Guide and mentor engineers on best practices for secure application development. • Stay ahead of emerging security trends, compliance standards, and attack vectors — particularly in fintech and blockchain domains.

• Support security automation and Identity & Access Management (IAM) initiatives • Implement Identity & Access Management (IAM) solutions • Develop automation for disparate security and IT tools using Python, Bash, and other technologies • Plan and execute mitigation strategies for known and emerging security threats • Ensure consistent application of security measures across business applications and infrastructure • Conduct security monitoring, SIEM analysis, and reporting • Ensure adherence to security frameworks (e.g., NIST CSF, CJIS, IRS 1075, CMS MARS-E)

• Continuous evaluation of several security tools including but not limited to Data Loss Prevention, Vulnerability Management, Identity and Access Management, Web Application Firewall, Email Protection and Endpoint Protection. • Evaluate and implement a Security, Orchestration, Automation and Response software. • Develop and maintain a library of scripts to be leveraged to automate threat hunting, detection, and digital forensics efforts. • Design, implement and refine security detection mechanisms to improve operational efficiency and observability. • Effectively maintain a cloud based SIEM by ensuring relevant logs are ingested and alerts are tuned. • Tasked with leveraging expertise in the area of incident response, this role may also function as the lead incident responder. • Stay up-to-date on the latest threats, vulnerabilities, and security trends to ensure that our organization is prepared to address emerging threats. • Conduct security awareness training by conducting internal phishing campaigns. • Collaborate with internal teams to ensure that secure implementation guidelines are followed. • Participate in an on-call rotation to provide 24/7 support for critical incident escalations.

This description is a summary of our understanding of the job description. Click on 'Apply' button to find out more. Role Description The Staff Security Engineer will be responsible for designing, implementing, and maintaining security services that support our business. You will understand data and automation are important ingredients to our mission and know how to actively employ these ingredients at scale. Beyond the technical expertise, we value individuals who can partner cross-functionally across various teams, driving impactful outcomes and further securing our digital landscape. - Lead the development, implementation, and ongoing maintenance of comprehensive security strategies and solutions. - Design and deploy advanced security controls to safeguard networks, systems, and applications. - Work across disciplines to shape our security services strategy and execution. - Mentor and galvanize new engineers to do their best work. - Set and uphold the standard for security processes to support high-quality engineering. Qualifications - BS/BTech (or higher) in Computer Science, Information Technology, Cybersecurity or a related field, 10 years security domain experience without degree. - 8+ years of experience in software or security engineering within Cloud Native environments. Requirements - Experience architecting, developing, and deploying large-scale distributed systems at scale. - Experience with cloud technologies, e.g., AWS, Azure, GCP. - Experience building continuous integration and continuous development (CI/CD) pipelines. - Strong familiarity with server-side web technologies (e.g., Java, Python, Scala, C#, C++, Go). - 4+ years of experience acting as a trusted technical decision-maker in a team setting, solving for short-term and long-term business value. - Experience with health-tech systems, like Electronic Health Records, Clinical data, etc. Domain Specific Experience - AppSec and AI/ML Security. - Lead AI/ML Security program for building SaaS systems using AI models including Gemni, Claude, LightLLM, and AWS Bedrock. - Design and implement robust security controls for AI/ML systems, covering model training, inference, and data pipelines. - Proactively identify and mitigate diverse threats, including model inversion, data poisoning, adversarial attacks, and prompt injection. - Collaborate seamlessly with data scientists, ML engineers, and DevOps teams to embed security throughout the entire AI/ML lifecycle. - Conduct thorough threat modeling and risk assessments for AI systems and algorithms. - Develop and implement methods to monitor AI systems for anomalous behavior and potential misuse. - Secure APIs and endpoints critical for model access and inference. Physical Requirements - Sitting for prolonged periods of time. - Extensive use of computers and keyboard. - Occasional walking and lifting may be required. Benefits - Flexible work schedules and the ability to work remotely are available for many roles. - Health, dental and vision insurance paid up to 80% for employees, dependents and domestic partners. - Robust time-off plan (21 days of PTO in your first year). - Two paid volunteer days and 11 paid holidays. - 12 weeks paid parental leave for all new parents. - Six weeks paid sabbatical after six years of service. - Educational Assistant Program and Clinical Employee Reimbursement Program. - 401(k) with up to 4% match. - Stock options. - And much more!