Application Security Engineer

Responsibilities

• Provide hands-on technical guidance to software developers throughout the vulnerability remediation lifecycle.
• Perform secure code reviews, validate false-positive determinations, coach developers on remediation, and threat model products.
• Drive vulnerability identification using SAST, DAST, SCA, and in-house AI tooling.
• Manage external penetration testing and support vulnerability risk assessment and remediation.
• Translate security and privacy requirements into technical requirements and carry out secure SDLC activities.
• Train engineers on secure coding practices, security standards, and current security threats.

Requirements

• Reason about security risk in complex environments and communicate it to technical and non-technical audiences.
• Write and maintain code in at least one modern programming language and one scripting language; Heartflow uses C++ and Python.
• Be comfortable with testing frameworks and CI/CD pipelines.
• Have experience using AI development tools such as Claude Code and GitHub Copilot for development and security testing.
• Have a BS in Computer Science or a related degree, or relevant certifications and equivalent experience.
• Have 5+ years of total experience, including at least one year in Application Security or performing security tasks in a development role.
• Have contributed to secure SDLC activities including threat modeling, code review, security testing, and vulnerability management.
• Understand or be able to discuss current security threats affecting machine learning and generative AI.
• Healthcare experience with HIPAA, HITRUST, regulated environments, or Software as a Medical Device is preferred.
• Familiarity with AWS or equivalent cloud providers, Terraform, Chef, Ansible, Docker, Kubernetes, and GitHub Actions is preferred.

Benefits

• Hybrid work arrangement requiring three days per week in the San Francisco office.
• Annual base salary range of $145,000 to $180,000, plus bonus and equity.
• Equal opportunity employment and a workplace commitment to support, inspire, and respect all individuals.