Role Description Spring Health is looking for a Senior Application Security Engineer II to join our growing Application Security team. Reporting to the Manager, Application Security, you will play a key role in maturing and expanding our AppSec programs — including established SAST, SCA, and DAST capabilities — while helping shape new initiatives such as a Secure AI Development Lifecycle (ADLC). You will work alongside a team of engineers who have laid a strong foundation, bringing your experience to help take these programs to the next level. This is a full-time, fully remote position open to candidates residing within the United States. Occasional travel to our NYC headquarters may be required. What you’ll do: - Contribute to the advancement of secure-by-design practices within the team’s S-SDLC program, including participation in architecture reviews, design consultations, and security guidance across the development lifecycle. - Mentor engineers on secure coding practices, AppSec fundamentals, and career growth, fostering a collaborative environment where the team grows stronger together. - Facilitate the development of an AI-assisted threat modeling program, spanning risk identification, security architecture, and proactive program maturity, enabling the ability to scale threat modeling across the organization. - Contribute to maturing the team’s established SAST, SCA, and DAST programs through rule tuning, coverage improvements, and identifying opportunities to strengthen security controls as the organization scales. - Perform security-focused code reviews of internal and open-source libraries, prioritizing findings by exploitability and business impact. - Support vulnerability remediation efforts by assessing impact, proposing solutions, and validating fixes in accordance with the team’s established remediation workflows. - Identify and implement process improvements and security automation using languages such as Go, Python, JavaScript, or Ruby, including the integration of AI tooling to improve team workflows and program efficiency. - Contribute to security assessments of AI-integrated product features, including LLM APIs, vector databases, and RAG pipelines, with a focus on risks such as prompt injection, data leakage, and model supply-chain vulnerabilities. - Contribute to the research, design, and development of a Secure AI Development Lifecycle (ADLC) in accordance with the OWASP Top 10 for LLM Applications and emerging adversarial ML guidance. - Evaluate and recommend AI-assisted security tooling, including AI-augmented SAST and LLM-powered code review, to improve program coverage and team efficiency. What success looks like: - Demonstrated improvements to the team’s SAST, SCA, and DAST programs through rule tuning, noise reduction, and coverage expansion within the first 90 days. - Delivery of a documented AI-assisted threat modeling program and foundational ADLC framework, including defined processes, tooling recommendations, and adoption milestones. - Consistent adherence to team SLAs for vulnerability triage and remediation, with measurable contributions to reducing time-to-remediation for high and critical findings. - Delivered security automation and AI tooling integrations that produce measurable improvements to program efficiency or engineering team experience. - Completed security assessments of AI-integrated product features with documented findings, risk ratings, and remediation guidance delivered to engineering teams. Qualifications - 7+ years of professional experience in application security or a closely related security engineering discipline, including experience working on complex, ambiguous problem areas independently. - Hands-on experience with DAST, SAST, and SCA tools, and manual testing techniques (OWASP, SANS Top 25). - Demonstrated experience securing CI/CD pipelines with commercial and custom-built tooling. - Experience with IaaS cloud infrastructure (AWS, Azure, or GCP), container technologies, and service-oriented architectures. - Security automation experience in at least one of: Go, Python, JavaScript, or Ruby. - Familiarity with AI/ML security concepts — prompt injection, adversarial inputs, model supply-chain risks, and the OWASP LLM Top 10. - Working knowledge of AI and LLM tooling (e.g., OpenAI, Anthropic, LangChain, or equivalent) sufficient to assess security risk and integrate into automated workflows. - Experience implementing controls aligned to NIST CSF, HIPAA, HITRUST, ISO-27001, or SOC-2. - Strong cross-functional collaboration skills, with experience working alongside engineering, product, and leadership stakeholders to define and advance security priorities and plans. - Bachelor’s degree in Computer Science, Engineering, MIS, IT, or equivalent work experience. Nice to have: - 3+ years of demonstrated experience in security architecture, including designing and reviewing security controls across cloud-based, distributed, or service-oriented systems. - Experience leading or contributing to the development of a formal threat modeling program, including tooling selection, methodology design, and adoption across engineering teams. - Hands-on experience evaluating or implementing AI security tooling, including AI-augmented testing, LLM security assessments, or automated risk analysis. - Experience managing a bug bounty or vulnerability disclosure program. - Experience in digital health, healthcare technology, or other HIPAA-regulated environments. Benefits - Health, Dental, Vision benefits start on your first day at Spring. - Employer sponsored 401(k) match of up to 2% for retirement planning. - A yearly allotment of no cost visits to the Spring Health network of therapists, coaches, and medication management providers for you and your dependents. - Competitive paid time off policies including vacation, sick leave and company holidays. - At 6 months tenure with Spring, parental leave of 18 weeks for birthing parents and 16 weeks for non-birthing parents. - Access to Noom, a weight management program tailored to your unique needs and goals. - Access to fertility care support through Carrot, in addition to $4,000 reimbursement for related fertility expenses. - Access to Wellhub, which connects employees to the best options for fitness, mindfulness, nutrition, and sleep in one subscription. - Access to BrightHorizons, which provides sponsored child care, back-up care, and elder care. - Up to $1,000 Professional Development Reimbursement a year. - $200 per year donation matching to support your favorite causes.

• Use AI-assisted threat modeling capabilities to identify application, platform, API, cloud, data, and AI/ML security risks early in the design and development process. • Leverage automated security review tools to evaluate architecture, design documents, code changes, APIs, and data flows for security gaps and control weaknesses. • Drive AI-assisted code security reviews using SAST, DAST, SCA, secrets detection, IaC scanning, container scanning, and contextual risk analysis. • Use automation and intelligent correlation to assess third-party libraries, APIs, vendor integrations, and open-source dependencies for security, compliance, and supply-chain risk. • Support AI-enabled red team, blue team, and incident response simulations to validate detection, prevention, and response capabilities. • Partner with developers and QA engineers to embed AI-driven security testing and automated risk detection into CI/CD pipelines. • Build and improve security automation that provides real-time feedback to developers during design, coding, testing, release, and deployment. • Use AI-assisted analysis to review architecture and design artifacts, identify risks earlier, and recommend secure implementation patterns. • Contribute to intelligent security checkpoints that reduce manual review effort while improving consistency, traceability, and developer velocity. • Help design scalable guardrails, reusable security controls, and policy-as-code capabilities across application and platform teams. • Monitor evolving application, cloud, API, AI/ML, and data security risks using AI-assisted threat intelligence, vulnerability intelligence, and attack-pattern analysis. • Identify and evaluate AI-specific threats such as prompt injection, data poisoning, model abuse, model leakage, insecure tool use, and sensitive data exposure. • Assist in designing and deploying proactive defense mechanisms across applications, APIs, data platforms, and AI-powered systems. • Use automated signals, telemetry, and risk scoring to support investigations, post-incident analysis, and continuous improvement of prevention and detection capabilities. • Translate recurring vulnerabilities and incidents into feedback loops that improve threat models, secure design patterns, and SDLC controls. • Promote secure coding and secure design practices through AI-assisted guidance, reusable playbooks, automated recommendations, and developer-friendly documentation. • Contribute to internal security standards, secure engineering patterns, and AI-native security playbooks. • Help teams adopt security self-service capabilities that reduce dependency on manual AppSec review. • Collaborate closely with Engineering, DevOps, QA, Product, and AI platform teams to foster a security-first and automation-first culture. • Use metrics and insights to measure control effectiveness, remediation trends, developer adoption, and overall security maturity.

• Developing cloud-native microservices and backend components in Golang • Building and maintaining SaaS infrastructure and services for scale and resiliency • Working with GCP, Kubernetes, and Linode, including development of Kubernetes operators • Using Helm, Terraform, GitHub Actions, and other modern tooling to support deployment and automation • Collaborating with other engineers, architects, and product managers to drive features end-to-end • Taking ownership of system design decisions and contribute to the long-term technical roadmap

• Own pre-ITO technical deliverables for all opportunities from assigned account managers, regardless of complexity • Gather from Customers and other sources information about each opportunity and the Customer’s development plan, strategy, and evaluation method • Inform Customers about GE technology and solutions through in-person and online presentations • Use thermodynamic modeling software to model Simple Cycle (SC), Combined Cycle (CC), and Combined Heat & Power (CHP) plants • When appropriate, work cross-functionally to conduct configuration optimization • Conduct economic life-cycle evaluation analysis of GE and competitor solutions for projects prior to RFP • Work closely with New Unit Sales and within the broader Applications Engineering and Product Line Management teams to ensure optimum GE competitiveness and establish a pre-ITO level of technical information flow to develop gas power projects • Proactively assess product fit and define an influencing strategy to best position GE prior to firm bid • Respond to Customer requests for technical information prior to RFP (Request For Proposal, formal), including providing transmission interconnect data and emissions data for permitting • Define and communicate to the ITO proposal team the project background, optimum configuration, necessary approvals obtained, and bid strategy • Gather competitive data and support post win and post mortem analyses including analyzing and reporting back to the business regional Customer needs and trends