Cyber Security Engineer (Application Security)

TherapyNotes provides behavioral health practice management and electronic health record software, including scheduling, billing, documentation, and telehealth solutions. The Cyber Security Engineer will own application security across the software development lifecycle and CI/CD pipeline, while supporting vulnerability management, incident response, identity and access security, compliance, and security tooling in a healthcare-regulated environment.

Responsibilities:

• Collaborate with developmental teams to ensure security is continuously integrated into the Software Development Lifecycle (SDLC) and CI/CD pipeline
• Enforce secure coding standards and best practices to minimize vulnerabilities and to protect the confidentiality, integrity, and availability of our customer's data
• Perform in-depth security assessments, code reviews, and threat modeling on applications to identify potential vulnerabilities and risks
• Own and operate GitHub Advanced Security — triage code, secret, and dependency-scanning findings, identify recurring vulnerability patterns and recommend broader fixes, and continuously improve scanning coverage, configuration, and workflows
• Secure CI/CD pipelines and GitHub Actions — identities, runners, permissions, and secrets — and reduce software supply chain risk through third-party action review, dependency controls, action pinning, and artifact provenance
• Review Terraform and other infrastructure-as-code for security issues, partnering with IT platform teams on IaC scanning and secure deployment practices
• Ensure application security measures align with healthcare regulations and standards (e.g., HIPAA, HITRUST, and HITECH) and support regular audits
• Collaborate with developers to remediate vulnerabilities, providing actionable guidance and ensuring effective patching or mitigation measures
• Develop, deploy, and manage security tools and technologies (e.g., SAST, DAST, vulnerability management systems) to automate security testing and scanning processes
• Support application security incident response activities, identifying the root cause of security incidents and contributing to resolution strategies
• Contribute to security awareness programs for the development teams, focusing on secure coding practices and proactive security measures

Requirements:

• 5+ years in application security or security engineering
• Demonstrated experience securing CI/CD pipelines and GitHub Actions — including SAST/DAST, code/secret/dependency-scanning triage (e.g., GitHub Advanced Security, Snyk), runner and workflow-permission security, and third-party action/supply-chain risk
• Experience reviewing Terraform or other infrastructure-as-code for security misconfigurations
• Working knowledge of SIEM, EDR/XDR, and DLP platforms — deployment, tuning, and alert triage
• Understanding of Zero Trust architecture principles and how they apply to application and identity access
• Strong understanding of healthcare regulations (HIPAA, HITECH, HITRUST) and their impact on application security
• Experience with API security, particularly integrations with other healthcare systems
• Prior experience securing cloud environments (Azure preferred, AWS a plus)
• Willingness to participate in an incident response on-call rotation
• Strong collaboration skills, able to work effectively with cross functional teams
• Bachelor's degree in information security, computer science, or related field
• equivalent experience considered
• familiarity with HL7 or other healthcare data standards
• Azure preferred, AWS a plus
• Industry certifications such as GWAPT, OSWE, GPEN, or a cloud security certification (Azure/AWS) are ideal
• CISSP or HCISPP a plus but not a substitute for hands-on tooling experience
• Passion for continuous learning and professional development, with a commitment to staying updated and trained on the latest trends and technologies
• Eagerness to engage in new challenges and adapt quickly
• Strong work ethic and drive to take ownership of projects and see them through to completion