Role Description
Spring Health is looking for a Senior Application Security Engineer II to join our growing Application Security team. Reporting to the Manager, Application Security, you will play a key role in maturing and expanding our AppSec programs — including established SAST, SCA, and DAST capabilities — while helping shape new initiatives such as a Secure AI Development Lifecycle (ADLC). You will work alongside a team of engineers who have laid a strong foundation, bringing your experience to help take these programs to the next level.
This is a full-time, fully remote position open to candidates residing within the United States. Occasional travel to our NYC headquarters may be required.
What you’ll do:
-
Contribute to the advancement of secure-by-design practices within the team’s S-SDLC program, including participation in architecture reviews, design consultations, and security guidance across the development lifecycle.
-
Mentor engineers on secure coding practices, AppSec fundamentals, and career growth, fostering a collaborative environment where the team grows stronger together.
-
Facilitate the development of an AI-assisted threat modeling program, spanning risk identification, security architecture, and proactive program maturity, enabling the ability to scale threat modeling across the organization.
-
Contribute to maturing the team’s established SAST, SCA, and DAST programs through rule tuning, coverage improvements, and identifying opportunities to strengthen security controls as the organization scales.
-
Perform security-focused code reviews of internal and open-source libraries, prioritizing findings by exploitability and business impact.
-
Support vulnerability remediation efforts by assessing impact, proposing solutions, and validating fixes in accordance with the team’s established remediation workflows.
-
Identify and implement process improvements and security automation using languages such as Go, Python, JavaScript, or Ruby, including the integration of AI tooling to improve team workflows and program efficiency.
-
Contribute to security assessments of AI-integrated product features, including LLM APIs, vector databases, and RAG pipelines, with a focus on risks such as prompt injection, data leakage, and model supply-chain vulnerabilities.
-
Contribute to the research, design, and development of a Secure AI Development Lifecycle (ADLC) in accordance with the OWASP Top 10 for LLM Applications and emerging adversarial ML guidance.
-
Evaluate and recommend AI-assisted security tooling, including AI-augmented SAST and LLM-powered code review, to improve program coverage and team efficiency.
What success looks like:
-
Demonstrated improvements to the team’s SAST, SCA, and DAST programs through rule tuning, noise reduction, and coverage expansion within the first 90 days.
-
Delivery of a documented AI-assisted threat modeling program and foundational ADLC framework, including defined processes, tooling recommendations, and adoption milestones.
-
Consistent adherence to team SLAs for vulnerability triage and remediation, with measurable contributions to reducing time-to-remediation for high and critical findings.
-
Delivered security automation and AI tooling integrations that produce measurable improvements to program efficiency or engineering team experience.
-
Completed security assessments of AI-integrated product features with documented findings, risk ratings, and remediation guidance delivered to engineering teams.
Qualifications
-
7+ years of professional experience in application security or a closely related security engineering discipline, including experience working on complex, ambiguous problem areas independently.
-
Hands-on experience with DAST, SAST, and SCA tools, and manual testing techniques (OWASP, SANS Top 25).
-
Demonstrated experience securing CI/CD pipelines with commercial and custom-built tooling.
-
Experience with IaaS cloud infrastructure (AWS, Azure, or GCP), container technologies, and service-oriented architectures.
-
Security automation experience in at least one of: Go, Python, JavaScript, or Ruby.
-
Familiarity with AI/ML security concepts — prompt injection, adversarial inputs, model supply-chain risks, and the OWASP LLM Top 10.
-
Working knowledge of AI and LLM tooling (e.g., OpenAI, Anthropic, LangChain, or equivalent) sufficient to assess security risk and integrate into automated workflows.
-
Experience implementing controls aligned to NIST CSF, HIPAA, HITRUST, ISO-27001, or SOC-2.
-
Strong cross-functional collaboration skills, with experience working alongside engineering, product, and leadership stakeholders to define and advance security priorities and plans.
-
Bachelor’s degree in Computer Science, Engineering, MIS, IT, or equivalent work experience.
Nice to have:
-
3+ years of demonstrated experience in security architecture, including designing and reviewing security controls across cloud-based, distributed, or service-oriented systems.
-
Experience leading or contributing to the development of a formal threat modeling program, including tooling selection, methodology design, and adoption across engineering teams.
-
Hands-on experience evaluating or implementing AI security tooling, including AI-augmented testing, LLM security assessments, or automated risk analysis.
-
Experience managing a bug bounty or vulnerability disclosure program.
-
Experience in digital health, healthcare technology, or other HIPAA-regulated environments.
Benefits
-
Health, Dental, Vision benefits start on your first day at Spring.
-
Employer sponsored 401(k) match of up to 2% for retirement planning.
-
A yearly allotment of no cost visits to the Spring Health network of therapists, coaches, and medication management providers for you and your dependents.
-
Competitive paid time off policies including vacation, sick leave and company holidays.
-
At 6 months tenure with Spring, parental leave of 18 weeks for birthing parents and 16 weeks for non-birthing parents.
-
Access to Noom, a weight management program tailored to your unique needs and goals.
-
Access to fertility care support through Carrot, in addition to $4,000 reimbursement for related fertility expenses.
-
Access to Wellhub, which connects employees to the best options for fitness, mindfulness, nutrition, and sleep in one subscription.
-
Access to BrightHorizons, which provides sponsored child care, back-up care, and elder care.
-
Up to $1,000 Professional Development Reimbursement a year.
-
$200 per year donation matching to support your favorite causes.
