Senior Application Security Engineer

Responsibilities

• Provide hands-on technical security guidance to software developers throughout the vulnerability remediation lifecycle.
• Perform secure code reviews, validate false positives, advise on remediation strategies, and threat model products.
• Drive vulnerability identification using SAST, DAST, SCA, and in-house AI tooling, and manage external penetration testing.
• Support vulnerability management, risk assessment, remediation improvements, and translation of security and privacy requirements into technical requirements.
• Train engineers on secure coding practices, security standards, and current security threats.

Requirements

• Have a BS in Computer Science or a related degree, or relevant certifications and equivalent experience.
• Have 5+ years of total experience, including at least one year in application security or performing security tasks in a development role.
• Have experience writing and maintaining code in at least one modern programming language and one scripting language; Heartflow uses C++ and Python.
• Have experience with secure SDLC activities such as threat modeling, code review, security testing, and vulnerability management.
• Be able to reason about security risk and communicate with technical and non-technical audiences.
• Have experience using AI coding tools such as Claude Code and GitHub Copilot for development and security testing.
• Have experience with or be able to discuss current machine-learning and generative-AI security threats.
• Healthcare knowledge including HIPAA, HITRUST, and Software as a Medical Device is helpful.
• Familiarity with AWS or equivalent cloud providers, Terraform, Chef, Ansible, Docker, Kubernetes, and GitHub Actions is helpful.

Benefits

• Hybrid work arrangement requiring three days per week in the San Francisco office.
• Base salary range of $165,000 to $200,000 per year, plus bonus and equity.
• Work on AI-powered healthcare products intended to improve patient outcomes.