高级应用安全工程师
Senior Application Security Engineer
_此职位为美国远程岗位。_
Turquoise 正在招聘一名高级应用安全工程师，负责我们客户依赖的应用程序和数据的安全。该职位负责 Turquoise 平台上的应用层安全，是基础设施安全的软件对应方。你将构建和优化我们的代码扫描计划，推动漏洞从发现到修复的全过程。日常工作中，你会与工程团队紧密合作，参与产品团队所构建的设计、架构和服务。
### **你将负责**
- 构建并运行我们的应用安全扫描计划（SAST、DAST、依赖项/SCA 扫描、容器和 IaC 扫描），优化工具以减少噪音并突出真实风险。
- 处理扫描、渗透测试和漏洞赏金报告的结果；根据风险优先级进行处理，并跟踪修复直至关闭。
- 与工程团队合作修复漏洞，必要时提供实际调试和代码层面的指导。
- 与工程、产品和设计团队建立信任与协作，使安全在流程早期就被考虑，而非在最后添加（成熟的 SDLC，CI/CD 流水线）。
- 进行威胁建模并维护安全编码标准。
- 支持应用层安全问题的事件响应。
- 协调并协助管理第三方渗透测试。
- 跟踪并报告安全态势指标（开放漏洞、修复 SLA、扫描覆盖率）给工程团队和管理层。
### **你将带来**
- 5 年以上应用安全、安全工程或具有安全重点的相关软件工程经验。
- 具有 SAST、DAST 和依赖项/SCA 扫描工具的实际操作经验，并具备区分真实风险与噪音的判断力。
- 对常见漏洞类别（OWASP Top 10、认证/授权缺陷、注入、SSRF 等）有深入理解，包括能够审查代码和架构以发现这些问题并提出有效的修复方案。
- 具有云环境（AWS 优先）经验以及对现代 CI/CD 流水线的安全保障经验。
- 具备良好的沟通能力，能够向工程师和非安全相关利益方清晰地解释风险和修复步骤。
- 一种协作且务实的安全方法，在降低风险的同时兼顾交付速度。
### **加分项**
- 在医疗保健、金融科技或其他监管行业的工作经验。
- 在合规框架内工作的经验。
查看英文原文
_This is a fully remote role in the United States._
Turquoise is hiring a Senior Application Security Engineer to drive security for the applications and data our customers rely on. This role owns application-layer security across Turquoise's platform and is the software counterpart to our infrastructure security. You'll build and tune our code scanning program, driving vulnerabilities from discovery to remediation. Day to day, you'll work closely with engineering teams on the design, architecture, and services our product teams build.
### **What You'll Do**
- Build and run our application security scanning program (SAST, DAST, dependency/SCA, container and IaC scanning), tuning tools to reduce noise and surface real risk.
- Triage findings from scans, penetration tests, and bug bounty reports; prioritize by risk and track remediation through to closure.
- Partner with engineering teams to fix vulnerabilities, including hands-on debugging and code-level guidance when needed.
- Build trust and cooperation with engineering, product, and design teams so security is considered early in the process, not bolted on at the end (mature SDLC, CI/CD pipelines).
- Perform threat modeling and maintain secure-coding standards.
- Support incident response for application-layer security issues.
- Coordinate and help manage third-party penetration tests.
- Track and report on security posture metrics (open vulnerabilities, remediation SLAs, scan coverage) to engineering and leadership.
### **What You'll Bring**
- 5+ years of experience in application security, security engineering, or a related software engineering role with a security focus.
- Hands-on experience with SAST, DAST, and dependency/SCA scanning tools, and the judgment to distinguish real risk from noise.
- Deep understanding of common vulnerability classes (OWASP Top 10, authentication/authorization flaws, injection, SSRF, etc.), including the ability to review code and architecture to spot these issues and propose effective fixes.
- Experience with cloud environments (AWS preferred) and securing modern CI/CD pipelines.
- Strong communication skills, able to explain risk and remediation steps clearly to engineers and non-security stakeholders alike.
- A collaborative, pragmatic approach to security that balances risk reduction with shipping velocity.
### **Nice to Have**
- Experience in healthcare, fintech, or another regulated industry.
- Experience working within compliance frameworks such as HIPAA, SOC 2, or GDPR.
- Security certifications such as OSCP, GWAPT, or CSSLP.
- Experience building or maturing an AppSec program from an early stage.
- Scripting or automation experience (Python, Go, Terraform, or infrastructure-as-code tool like Terraform.
- Red team experience performing internal campaigns and providing remediation reports
### **Benefits**
- Competitive pay with equity options
- Stellar health care plan options (Medical, Dental & Vision), with FSA, DCFSA, & HSA options
- Company-sponsored disability & life insurance
- Unlimited PTO
- 401(k) + 4% Matching
- Fully remote work + flexible working hours
- $750 work-from-home setup budget
- Paid biannual in-person company summits
- Quarterly $150 co-hanging stipend to meet up with coworkers
- Monthly $100 health and wellness benefit
- Generous paid family leave
- Annual $1,200 learning & development stipend
## **About Turquoise Health**
Turquoise Health is a Series C price transparency platform for finance leaders across healthcare. Backed by a16z, Oak HC/FT, Adams Street, Yosemite, Bessemer Venture Partners, and others, we power price transparency for 300+ enterprise organizations and are building the infrastructure for a more open, efficient healthcare marketplace. We're a remote-first, US-based team that values transparency, empathy, inclusivity, creativity, and ownership.
We operate on US business hours and work with clients entirely based in the US. For this role, we are seeking US-based candidates.
_We strongly encourage BIPOC, people with disabilities, and LGBTQIA+ folks to apply for any open roles of interest. Healthcare affects all people differently, but it significantly affects those in underserved communities. With a robust, diverse team, we are stronger and better equipped to change the future of healthcare for all._
### **Work Authorization**
This role requires current authorization to work in the United States. Turquoise does not sponsor employment visas (H-1B, PERM, etc.) or assume sponsorship of existing visas for this position.
### **Disability Accommodation Email**
Turquoise is committed to providing reasonable accommodations to applicants and employees with disabilities. Please tell us if you require a reasonable accommodation to apply for a job or to perform your job. Examples of reasonable accommodation include making a change to the application process or work procedures, providing documents in an alternate format, using a sign language interpreter, or using specialized equipment. If you require assistance or an accommodation with the hiring process, please contact recruiting@turquoise.health
Note: All official communication from Turquoise will come from a **@turquoise.health** email address and all open roles are listed at turquoise.health/careers. We never ask candidates for payment or financial information. If you're contacted by anyone using a different domain, please disregard and report it as spam.