Senior Application Security Engineer

ModMed is hiring a Senior Application Security Engineer to advance the security of our applications by working closely with development and engineering teams. This role will focus on embedding security into our software development lifecycle, performing hands-on security assessments, and ensuring proactive defenses across our application stack. This is an exciting and high-impact opportunity within a fast-paced Healthcare IT company that is truly Modernizing Medicine!

Your Role:

• Application Security Assessment: Conduct application security testing, including Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST), identifying vulnerabilities and working with development teams to remediate them.
• Collaborate with Development Teams: Partner with software engineers to integrate security best practices, review code for potential security issues, and support secure design in new applications and features.
• SAST and SCA Implementation: Support the rollout of Snyk for SAST and Software Composition Analysis (SCA), focusing on accurate detection of vulnerabilities in code and third-party libraries.
• Threat Modeling and Risk Identification: Perform threat modeling and risk assessment exercises to identify security risks early in the development process.
• Develop Security Standards: Contribute to the creation and enforcement of application security standards and policies, ensuring consistent security practices across development teams.
• Incident Analysis and Remediation: Assist in investigating and responding to application-related security incidents, performing root cause analysis, and implementing solutions to prevent reoccurrence.

Skills & Requirements:

• Bachelor’s degree in Computer Science, Information Systems, or a related field, or equivalent experience.
• 5+ years of experience in application security, with strong knowledge of secure coding practices and application security frameworks.
• Experience with SAST/SCA tools (e.g., Snyk, Checkmarx, or similar), including integration and remediation support.
• Strong understanding of the OWASP Top Ten, secure design principles, and best practices for preventing common vulnerabilities.
• Experience in threat modeling and a solid grasp of risk assessment methodologies.
• Programming skills for security code review (e.g., Python, Java, JavaScript) and familiarity with cloud security, preferably in AWS environments.
• Excellent communication and collaboration skills to effectively work with cross-functional teams and convey complex security concept

LI-LA1