SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 150,000 - 200,000 / annual
K Health is seeking a Senior Security Engineer for Application Security to join its InfoSec team. This role focuses on protecting the company's infrastructure, applications, cloud security, and customer trust within a highly regulated healthcare technology environment. You will operate with significant autonomy to define and implement cutting-edge security solutions across the entire technical ecosystem.
Key responsibilities include:
- Lead development and implementation of robust application security protocols throughout the Software Development Lifecycle (SDLC)
- Partner with engineering teams to embed security into architecture, design, development, testing, and deployment
- Perform hands-on security testing of web applications, APIs, cloud-native services, and supporting infrastructure
- Build and improve automated security testing within CI/CD pipelines, including static analysis, dependency scanning, secrets detection, container scanning, and dynamic testing
- Evaluate and improve application security tools, reducing unnecessary findings and developer friction
- Develop secure coding standards with developer-focused documentation
- Contribute application security expertise to vulnerability management, security incidents, investigations, and post-incident reviews
- Evaluate third-party applications, libraries, APIs, and integrations for security risk
- Ensure adherence to healthcare regulatory and compliance requirements (HIPAA, GDPR, etc.) across all product lines and systems
K Health is an AI-powered virtual care platform founded in 2016, headquartered in New York City, and backed by over $443.5M from leading investors. The company modernizes primary care through clinical AI solutions for patients, provider-serving agentic solutions to reduce administrative burden, and AI-powered virtual clinics for health systems.
REQUIREMENTS:
- 4+ years of professional experience in application, product, or software security as an individual contributor, OR as a software engineer who has pivoted into security
- Strong understanding of application security vulnerabilities and attack techniques, including OWASP Top 10 and API security risks
- Experience performing manual security testing of modern web applications, APIs, and distributed systems
- Ability to review application architecture and source code for security weaknesses
- Experience integrating application security tools into modern CI/CD workflows
- Familiarity with static application security testing, dynamic testing, secrets detection, container security, and infrastructure-as-code scanning
- Understanding of authentication, authorization, session management, cryptography, secrets management, and secure API design
- Strong expertise in cloud technology (AWS, GCP, or Azure), modern programming languages, and understanding of security implications of generative coding utilities and AI code development tools
- Demonstrated experience researching, establishing, and successfully rolling out enterprise-wide security policies and guidelines
BONUS:
- Experience with specific tools including Datadog, Sumologic, Torq, flare.io, GCP, Entitle, Okta, Orca, GitLab, Prisma
- Interest in exploring and implementing bleeding-edge technology
