Application Security Engineer

Strive Health is hiring an Application Security Engineer to embed security throughout its product development lifecycle, including work on Canvas Medical, patient-facing experiences, and future mobile applications. The role partners with Product and Engineering to establish secure design practices, testing frameworks, vulnerability remediation processes, and compliance evidence.

Responsibilities:

• Perform threat modeling and establish a security baseline for internal environments, patient portals, mobile applications, and integration services
• Maintain data-flow and trust-boundary diagrams, assessing identity, operational, and PHI data classifications
• Collaborate with engineering teams to embed security acceptance criteria into PRDs, technical plans, and Jira stories
• Conduct architecture reviews focusing on tenant boundaries, server-side authorization, prevention of IDOR (insecure direct object references), and lateral movement guardrails
• Develop and enforce merge request (MR) checklists covering authentication, input validation, secrets management, and cryptography
• Design, deploy, and operate application security testing tools including SAST, DAST, Software Composition Analysis (SCA), and container/IaC scanning
• Perform authenticated testing of browser workflows and APIs (e.g., using Burp Suite Enterprise)
• Conduct manual testing for complex vulnerabilities such as privilege escalation, SSRF, and business-logic abuse
• Manage the vulnerability intake pipeline, assign severities, and track remediation aligned with internal SLAs
• Lead recurring vulnerability review sessions with Security, Product, and Engineering stakeholders
• Coordinate external penetration tests, including scoping, vendor selection, and tracking of remediation/retesting
• Ensure all security requirements, threat models, testing evidence, and remediation documentation align with internal compliance needs (e.g., HITRUST, SOC 2)

Requirements:

• Bachelor's degree in Computer Science, Information Security, or a related field
• 3+ years (Engineer) to 5+ years (Senior) of experience in information security, with a strong focus on Application Security, DevSecOps, or software engineering
• Demonstrable experience integrating security tools into CI/CD pipelines (e.g., SAST, DAST, SCA)
• Experience leading or performing application threat modeling, architecture reviews, and manual security testing
• Familiarity with securing cloud environments (SaaS, IaaS, PaaS) and understanding of cloud architecture
• Excellent problem-solving and analytical skills, able to assess complex application security issues and provide practical, developer-friendly solutions
• Strong communication and collaboration skills; capable of articulating technical risk to both technical and non-technical stakeholders
• Proactive and adaptable, comfortable embedding directly with engineering pods to shift security “left”
• At this time Strive Health is unable to provide work visa sponsorship
• Experience within the healthcare sector, securing environments that manage PHI and complying with frameworks like HITRUST
• Deep expertise in identifying and exploiting vulnerabilities (OWASP Top 10, IDOR, SSRF, authentication bypass)
• Experience with testing and securing complex API integrations, mobile application releases, and web-based portals
• Familiarity with enterprise dynamic testing tools (e.g., Burp Suite Enterprise) and automating security testing against deployed applications
• Advanced certifications in application security or information security (e.g., CSSLP, GWAPT, CISSP, CEH)