Application Security Engineer
Core
Embed application security into the product development lifecycle for patient-facing experiences and mobile apps, ensuring secure design through production.
Role type
Application Security Engineer (DevSecOps)
Builds
Canvas Medical patient portals, mobile applications, and integration services
Domain
Healthcare / Application Security
Required skills
Application security, DevSecOps, CI/CD pipeline integration, threat modeling, architecture reviews, manual security testing, vulnerability management, compliance frameworks (HITRUST, SOC 2), cloud security (SaaS/IaaS/PaaS), API security, mobile app security
Preferred skills
Healthcare sector experience, PHI handling, OWASP Top 10 exploitation, complex API integration security, enterprise dynamic testing tools (Burp Suite Enterprise), advanced security certifications (CSSLP, GWAPT, CISSP, CEH)
Technologies
SAST, DAST, SCA, Burp Suite Enterprise, Jira, CI/CD tools
Responsibilities
Perform threat modeling and establish security baselines for internal environments and patient portals; Collaborate with engineering to embed security acceptance criteria into PRDs and technical plans; Design, deploy, and operate application security testing tools (SAST, DAST, SCA); Manage vulnerability intake pipeline and coordinate external penetration tests; Ensure security requirements align with compliance needs (HITRUST, SOC 2)
Seniority
Mid-level to Senior, hands-on IC