Security Engineer

Ceresti Health is a tech-enabled dementia care provider. The Security Engineer partners with Engineering to secure code and cloud systems, build security tooling and automation, test for vulnerabilities, and contribute to security architecture.

Responsibilities:

• Build and maintain threat models for new and existing systems and features, and keep them current as architecture changes
• Read checked-in code and assess its security. This role reviews code; it does not only review reports about code
• Own Snyk and Docker Scout: thresholds, findings, and driving remediation with the owning teams
• Review the software bill of materials for outdated or vulnerable components and push fixes through to closure
• Review SAST and DAST output, prioritize what matters, and work the remediation with engineers directly
• Build security utility tools and automation that Engineering and the wider company use
• Write scripts for logging, data parsing, and signal enrichment that make controls smarter rather than noisier
• Integrate security systems with developer tooling so the safe path is the convenient one
• Build and tune detection logic and automation that the Security Analyst operates day to day
• Build penetration tests and attack simulations using AI and the tools we already run, and use Dev, QA, and Test as a test bed to demonstrate real exposure
• Feed results from Pentest-Tools and internal testing back into what you build next
• Scope, coordinate, and manage the independent third-party penetration test required for SOC 2 and HITRUST, and track findings to closure
• Contribute to security architecture and standards, as well as detection logic
• Represent security in engineering initiatives including the mobile app, tablet software, the data lake, and AI and machine-learning work
• Help secure the production cloud environment (AWS via Aptible) as part of Engineering's platform, as code wherever possible

Requirements:

• Five to seven years in software or security engineering. Not a first engineering job
• You write code comfortably and would be at home on a development team. Python, Go, or similar
• Hands-on application security: threat modeling, dependency and container scanning, and reading code for security flaws
• Working knowledge of cloud security in AWS, and of CI/CD pipelines and where security fits in them
• Offensive fundamentals: you can think like an attacker and build a test that proves a point
• The ability to explain a finding to an engineer in terms they will act on
• Experience with Snyk, Docker Scout, or comparable SAST, SCA, and container tooling
• Detection engineering: writing and tuning rules that hold up in production
• An OSCP-type certification, or equivalent demonstrable offensive work
• Healthcare, or another environment handling regulated data
• Experience in a company where security was being built rather than inherited