Product Security Engineer

Modern Health is a mental health benefits platform for employers, providing comprehensive support for employees' well-being. The Product Security Engineer will play a crucial role in maintaining the security and privacy of users by analyzing vulnerabilities, implementing security standards, and collaborating with engineering teams to enhance security practices.

Responsibilities:

• Analyze security vulnerabilities in web and mobile applications, determine risk levels, and drive remediations in collaboration with engineering teams
• Research and report on potential product threats, emerging vulnerabilities, and mitigation techniques relevant to the evolving health tech landscape
• Partner with Engineering and Product stakeholders to integrate security at every stage of the SDLC, championing secure development practices and agile delivery
• Develop and advocate for cost-effective solutions to address complex application and product security challenges
• Implement the adoption of product security standards and best practices across the organization, influencing engineering and architecture decisions
• Routinely test, audit, and assess the security posture of application and cloud infrastructure configurations
• Guide engineering teams in applying secure coding standards, providing resources and actionable feedback to foster a culture of security
• Deploy, optimize, and manage security tooling such as SAST, DAST, Hashicorp Vault, and other industry-leading application security solutions
• Participate in collaborative threat modeling initiatives for new features and evolving services, ensuring proactive risk identification and reduction
• Conduct secure code reviews on services and applications built with modern frameworks and technologies
• Assist in planning and executing targeted penetration tests on new features, identifying and reporting vulnerabilities before production release
• Collaborate on IT security initiatives, partnering with infrastructure and operations teams to review security controls for device management, endpoint protection, access management, and overall IT hygiene
• Engage with Cloud Security efforts by partnering with DevOps and Infrastructure teams to assess, improve, and monitor cloud architecture, security policies, and cloud-native controls to ensure secure deployment and operations of applications and services

Requirements:

• You are a passionate and confident team member that takes pride and ownership in the work you do
• You are deeply familiar with secure software development practices, security-focused architecture, and infrastructure that aligns with product objectives and business needs
• You support the adoption of application and product security best practices across engineering teams and contribute to business-wide security initiatives
• You have hands-on experience with vulnerability management, secure code review, threat modeling, and industry-standard tools for application and product security
• You have hands-on experience with at least one scripting language (Python and/or Bash preferred)
• You thrive in fast-paced, collaborative environments, working closely with developers, product managers, and cross-functional stakeholders to secure web and mobile applications
• You are able to assess, prioritize, and execute on projects independently
• You are comfortable working in a fast-paced environment
• You have excellent written and verbal communication skills
• You bring 2-4 years of experience in product/application security or 1-3 years in security-focused software engineering
• You have experience integrating security into agile product delivery
• Immigration sponsorship is not available for this position. Applicants must be able to maintain work authorization for the duration of employment without employer sponsorship or employer-provided training plans or attestations (including, for example, the Form I-983 required for STEM OPT)
• Working at a high growth startup
• Working on SaaS software
• Working in Health Tech
• Software engineering experience