Senior Application Security Engineer

This is a fully remote role in the United States.

Turquoise is hiring a Senior Application Security Engineer to drive security for the applications and data our customers rely on. This role owns application-layer security across Turquoises platform and is the software counterpart to our infrastructure security. Youll build and tune our code scanning program driving vulnerabilities from discovery to remediation. Day to day youll work closely with engineering teams on the design architecture and services our product teams build.

What Youll Do

Build and run our application security scanning program (SAST DAST dependency/SCA container and IaC scanning) tuning tools to reduce noise and surface real risk.

Triage findings from scans penetration tests and bug bounty reports; prioritize by risk and track remediation through to closure.

Partner with engineering teams to fix vulnerabilities including hands-on debugging and code-level guidance when needed.

Build trust and cooperation with engineering product and design teams so security is considered early in the process not bolted on at the end (mature SDLC CI/CD pipelines).

Perform threat modeling and maintain secure-coding standards.

Support incident response for application-layer security issues.

Coordinate and help manage third-party penetration tests.

Track and report on security posture metrics (open vulnerabilities remediation SLAs scan coverage) to engineering and leadership.

What Youll Bring

5 years of experience in application security security engineering or a related software engineering role with a security focus.

Hands-on experience with SAST DAST and dependency/SCA scanning tools and the judgment to distinguish real risk from noise.

Deep understanding of common vulnerability classes (OWASP Top 10 authentication/authorization flaws injection SSRF etc.) including the ability to review code and architecture to spot these issues and propose effective fixes.

Experience with cloud environments (AWS preferred) and securing modern CI/CD pipelines.

Strong communication skills able to explain risk and remediation steps clearly to engineers and non-security stakeholders alike.

A collaborative pragmatic approach to security that balances risk reduction with shipping velocity.

Nice to Have

Experience in healthcare fintech or another regulated industry.

Experience working within compliance frameworks such as HIPAA SOC 2 or GDPR.

Security certifications such as OSCP GWAPT or CSSLP.

Experience building or maturing an AppSec program from an early stage.

Scripting or automation experience (Python Go Terraform or infrastructure-as-code tool like Terraform.

Red team experience performing internal campaigns and providing remediation reports

Benefits

Competitive pay with equity options

Stellar health care plan options (Medical Dental & Vision) with FSA DCFSA & HSA options

Company-sponsored disability & life insurance

Unlimited PTO

401(k) 4% Matching

Fully remote work flexible working hours

$750 work-from-home setup budget

Paid biannual in-person company summits

Quarterly $150 co-hanging stipend to meet up with coworkers

Monthly $100 health and wellness benefit

Generous paid family leave

Annual $1200 learning & development stipend

About Turquoise Health

Turquoise Health is a Series C price transparency platform for finance leaders across healthcare. Backed by a16z Oak HC/FT Adams Street Yosemite Bessemer Venture Partners and others we power price transparency for 300 enterprise organizations and are building the infrastructure for a more open efficient healthcare marketplace. Were a remote-first US-based team that values transparency empathy inclusivity creativity and ownership. We operate on US business hours and work with clients entirely based in the US. For this role we are seeking US-based candidates. We strongly encourage BIPOC people with disabilities and LGBTQIA folks to apply for any open roles of interest. Healthcare affects all people differently but it significantly affects those in underserved communities. With a robust diverse team we are stronger and better equipped to change the future of healthcare for all.

Work Authorization

This role requires current authorization to work in the United States. Turquoise does not sponsor employment visas (H-1B PERM etc.) or assume sponsorship of existing visas for this position.

Disability Accommodation Email

Turquoise is committed to providing reasonable accommodations to applicants and employees with disabilities. Please tell us if you require a reasonable accommodation to apply for a job or to perform your job. Examples of reasonable accommodation include making a change to the application process or work procedures providing documents in an alternate format using a sign language interpreter or using specialized equipment. If you require assistance or an accommodation with the hiring process please contact

Note: All official communication from Turquoise will come from a

@

email address and all open roles are listed at We never ask candidates for payment or financial information. If youre contacted by anyone using a different domain please disregard and report it as spam. Required Experience: Senior IC