Senior Application Security Engineer

Turquoise is a healthcare price transparency platform building infrastructure for a more open and efficient healthcare marketplace. The Senior Application Security Engineer will own application-layer security across the platform, including scanning, vulnerability remediation, threat modeling, secure coding, incident response, and collaboration with engineering teams.

Responsibilities:

• Build and run our application security scanning program (SAST, DAST, dependency/SCA, container and IaC scanning), tuning tools to reduce noise and surface real risk
• Triage findings from scans, penetration tests, and bug bounty reports; prioritize by risk and track remediation through to closure
• Partner with engineering teams to fix vulnerabilities, including hands-on debugging and code-level guidance when needed
• Build trust and cooperation with engineering, product, and design teams so security is considered early in the process, not bolted on at the end (mature SDLC, CI/CD pipelines)
• Perform threat modeling and maintain secure-coding standards
• Support incident response for application-layer security issues
• Coordinate and help manage third-party penetration tests
• Track and report on security posture metrics (open vulnerabilities, remediation SLAs, scan coverage) to engineering and leadership

Requirements:

• 5+ years of experience in application security, security engineering, or a related software engineering role with a security focus
• Hands-on experience with SAST, DAST, and dependency/SCA scanning tools, and the judgment to distinguish real risk from noise
• Deep understanding of common vulnerability classes (OWASP Top 10, authentication/authorization flaws, injection, SSRF, etc.), including the ability to review code and architecture to spot these issues and propose effective fixes
• Strong communication skills, able to explain risk and remediation steps clearly to engineers and non-security stakeholders alike
• A collaborative, pragmatic approach to security that balances risk reduction with shipping velocity
• This role requires current authorization to work in the United States
• Turquoise does not sponsor employment visas (H-1B, PERM, etc.) or assume sponsorship of existing visas for this position
• Experience with cloud environments (AWS preferred) and securing modern CI/CD pipelines
• Experience in healthcare, fintech, or another regulated industry
• Experience working within compliance frameworks such as HIPAA, SOC 2, or GDPR
• Security certifications such as OSCP, GWAPT, or CSSLP
• Experience building or maturing an AppSec program from an early stage
• Scripting or automation experience (Python, Go, Terraform, or infrastructure-as-code tool like Terraform
• Red team experience performing internal campaigns and providing remediation reports